I created a SharePoint-Add-In (provider hosted) which serves as a proxy for retrieving information from Microsoft Graph.
From the client I issue AJAX requests to my MVC-based web service which in turn calls the endpoint of the Graph API.
Currently I attempt to get my "trending items" from


which works quite well. The response contains JSON objects that have a property


The property, though, does not contain any URL with a picture but provides me wit an endpoint for an octet-stream - it looks like this:

https://tenant.sharepoint.com/_api/v2.0/drives/{gibberish}/items/{more gibberish}/thumbnails/0/small/thumbnailContent

This means I need to go there, fetch those bytes and make an image from them. So far I tried opening a ClientContext and retrieve the credentials - yet there are none (ClientContext.Credentials == null) and issuing the call leads to HTTP 401. Calling the URI from the browser yields a HTTP 403. My host web is


could it be that something is preventing a cross-domain call?

Calling SharePoint using the CSOM works fine though, I get the host web and the current user.

I use SharePoint Online (duh!) and have a provider hosted add-in on-prem. What do I need to do to fetch the image data? Thank you for your help.



  • provider hosted SharePoint-Add-In on SharePoint online tenant
  • add-in serves as a proxy for client to call Microsoft Graph API (works fine)
  • calling https://graph.microsoft.com/beta/me/insights/trending works fine, too
  • JSON result contains a property previewImageUrl for each item
  • previewImageUrl references a URI such as https://tenant.sharepoint.com/_api/v2.0/drives/{gibberish}/items/{more gibberish}/thumbnails/0/small/thumbnailContent, type of such is octet-stream
  • host web URL is of the pattern https://tenant.sharepoint.com/sub/site whereas previewImageUrl refers to root site collection (see bullet above)
  • no add-in web

Attempts (and fails):

  • calling the URL from browser gives HTTP 403
  • calling the URL from the .NET backend gives HTTP 401
    • ClientContext.Credentials == null
    • ClientContext.Authentication == Anonymous
    • using WebRequestExecutor does not help (passing credentials from ClientContext)
    • using any other means of HttpWebRequest-like classes fails
  • granting tenant read permissions to the add-in does not help either
  • finding proper documentation on MSDN


  • authenticating against Microsoft Graph using Azure AD
  • calling endpoints from Microsoft Graph API
  • using CSOM to get current web (host web) and current user by creating user client context

What do I need to do to get those bytes? Thank you

  • Did you ever find the answer for this? I'm in a similar situation, where I'm using the MS Graph API to get trending items for the user, and that works fine, but when I try to get the data from previewImageUrl, I get authorization errors, and I can't figure out how or where to get the right token for that URL.
    – Amy T
    Jun 10 '20 at 14:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.