If I go to Microsoft's Graph Explorer and use a URL like:


I can see my request succeeds.

Now if I use the Angular app from GitHub, and the code like

 private sharePointHost: string = "https://4development106.sharepoint.com/sites/DBSchenker/_api/web/lists/getByTitle('OEC_Docs')/items"

    const httpOptions = {
      headers: new HttpHeaders({
          'Accept':  'application/json;odata=verbose'
          ,'Authorization' : "Bearer " + token

    this.http.get(this.sharePointHost, httpOptions).subscribe(
      (resp) => console.log("respon is::: " + JSON.stringify(resp)),
      (err) => console.log("error:::" + JSON.stringify(err))

It throws:

error:::{"headers":{"normalizedNames":{},"lazyUpdate":null},"status":401,"statusText":"OK","url":"https://4development106.sharepoint.com/sites/DBSchenker/_api/web/lists/getByTitle('OEC_Docs')/items","ok":false,"name":"HttpErrorResponse","message":"Http failure response for https://4development106.sharepoint.com/sites/DBSchenker/_api/web/lists/getByTitle('OEC_Docs')/items: 401 OK","error":{"error_description":"Invalid JWT token. No certificate thumbprint specified in token header."}}

changing the host to (which works in the Graph API explorer)

private sharePointHost: string = "https://graph.microsoft.com/beta/sites/4development106.sharepoint.com:/sites/DBSchenker:/lists/OEC_Docs/items"


error:::{"headers":{"normalizedNames":{},"lazyUpdate":null},"status":401,"statusText":"Unauthorized","url":"https://graph.microsoft.com/beta/sites/4development106.sharepoint.com:/sites/DBSchenker:/lists/OEC_Docs/items","ok":false,"name":"HttpErrorResponse","message":"Http failure response for https://graph.microsoft.com/beta/sites/4development106.sharepoint.com:/sites/DBSchenker:/lists/OEC_Docs/items: 401 Unauthorized","error":{"error":{"code":"InvalidAuthenticationToken","message":"Access token validation failure.","innerError":{"request-id":"f5a77afc-0d92-49a0-92c4-e727e056d0a9","date":"2018-10-30T01:42:02"}}}}

I am not sure what I am doing wrong

1 Answer 1


Most likely you haven't added sufficient permissions for your app in Azure AD.

If you want to use MS Graph endpoint to access SharePoint data, you should add SharePoint permissions for MS Graph in Azure portal (SharePoint permissions correspond to "site collections"):
enter image description here

If you want to use direct SharePoint REST API (https://4development106.sharepoint.com/sites/DBSchenker/_api/web...), then you should Office 365 SharePoint Online permissions to your registered app:

enter image description here

  • where do i access azure AD. overall very confusing stuff as lot of documents indicate that if i am logged in then for local host i dont need to even worry about permissions. and while creating the app i did add Sites.ReadWriteAll
    – Vik
    Oct 30, 2018 at 16:08
  • Open your Azure portal, then go Azure Active Directory management view, select your registered app, then under Settings -> Required permissions give the app all permissions you need Oct 30, 2018 at 16:17
  • this is what i have for graph api: dropbox.com/s/gc8ziw9ehhjxihh/… but this still fails with "error":{"code":"InvalidAuthenticationToken","message":"Access token validation failure."
    – Vik
    Oct 30, 2018 at 17:27
  • and to mention i could not even find office 365 sharepoint apis. the one with closest name is share point apis which on clicking says use graph apis.
    – Vik
    Oct 30, 2018 at 17:27
  • You use App registrations Preview, that's why you see a bit different UI. From your screen, it looks like permissions are good for accessing SharePoint from graph endpoint, but not from SharePoint REST. You should add SharePoint permissions using corresponding SharePoint link in preview or office 365 sharepoint apis in regular app registration view. For "Access token validation failure" - it seems there are some issues with your MSAL implementation. I suggest asking at github issues about your problem. Oct 30, 2018 at 18:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.