I unable to perform any request to SharePoint Online via REST Api. It was used service high-trust authorization (App Only) to get access token. JSON Web Token, I've got, looks valid, see decoded version:

  u'ver': u'1.0',
  u'aud': u'https://<tenant>.sharepoint.com',
  u'roles': [
  u'iss': u'https://sts.windows.net/<some guid>/',
  u'oid': u'<some guid>',
  u'idp': u'https://sts.windows.net/<some guid>/',
  u'appidacr': u'2',
  u'aio': u'<some encoded data>',
  u'exp': 1510588040,
  u'appid': u'<some guid>',
  u'tid': u'<some guid>',
  u'iat': 1510584140,
  u'app_displayname': u'<Name of my OAuth application>',
  u'nbf': 1510584140,
  u'sub': u'<some guid>'

After getting access token, via jwt assertion, I was able to perform API calls to GraphAPI. The same approach was used for SharePoint Online but unfortunately all of requests (see bellow) returned 401 UNAUTHORIZED to me:

GET http://<tenant>.sharepoint.com/_api/web

GET http://<tenant>.sharepoint.com/_api/web/lists

Note: I tried it on a few Microsoft tenants, everything worked well except one tenant, I'm writing. I've already checked does my OAuth app got all required permissions and everything looks fine.

Probably it is a tenant related issue. I don't know where to dig in.

1 Answer 1


This appears to be similar to this problem with apponly tokens with some O365 tenancies.



  • Thank you very much for help, unfortunately neither of the topics didn't help. Will ask Microsoft support to help. Commented Nov 20, 2017 at 9:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.