I created a SharePoint-Add-In (provider hosted) which serves as a proxy for retrieving information from Microsoft Graph.
From the client I issue AJAX requests to my MVC-based web service which in turn calls the endpoint of the Graph API.
Currently I attempt to get my "trending items" from


which works quite well. The response contains JSON objects that have a property


The property, though, does not contain any URL with a picture but provides me wit an endpoint for an octet-stream - it looks like this:

https://tenant.sharepoint.com/_api/v2.0/drives/{gibberish}/items/{more gibberish}/thumbnails/0/small/thumbnailContent

This means I need to go there, fetch those bytes and make an image from them. So far I tried opening a ClientContext and retrieve the credentials - yet there are none (ClientContext.Credentials == null) and issuing the call leads to HTTP 401. Calling the URI from the browser yields a HTTP 403. My host web is


could it be that something is preventing a cross-domain call?

Calling SharePoint using the CSOM works fine though, I get the host web and the current user.

I use SharePoint Online (duh!) and have a provider hosted add-in on-prem. What do I need to do to fetch the image data? Thank you for your help.



  • provider hosted SharePoint-Add-In on SharePoint online tenant
  • add-in serves as a proxy for client to call Microsoft Graph API (works fine)
  • calling https://graph.microsoft.com/beta/me/insights/trending works fine, too
  • JSON result contains a property previewImageUrl for each item
  • previewImageUrl references a URI such as https://tenant.sharepoint.com/_api/v2.0/drives/{gibberish}/items/{more gibberish}/thumbnails/0/small/thumbnailContent, type of such is octet-stream
  • host web URL is of the pattern https://tenant.sharepoint.com/sub/site whereas previewImageUrl refers to root site collection (see bullet above)
  • no add-in web

Attempts (and fails):

  • calling the URL from browser gives HTTP 403
  • calling the URL from the .NET backend gives HTTP 401
    • ClientContext.Credentials == null
    • ClientContext.Authentication == Anonymous
    • using WebRequestExecutor does not help (passing credentials from ClientContext)
    • using any other means of HttpWebRequest-like classes fails
  • granting tenant read permissions to the add-in does not help either
  • finding proper documentation on MSDN


  • authenticating against Microsoft Graph using Azure AD
  • calling endpoints from Microsoft Graph API
  • using CSOM to get current web (host web) and current user by creating user client context

What do I need to do to get those bytes? Thank you

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.