sharepoint

# SharePoint (connected) App-only access through Microsoft Graph. Credentials in `$SHAREPOINT_TENANT_ID`, `$SHAREPOINT_CLIENT_ID` and `$SHAREPOINT_CLIENT_SECRET`; `$SHAREPOINT_HOSTNAME` may hold the tenant's host (`contoso.sharepoint.com`). There is no user behind this token — it is the app itself, so "my files" / OneDrive personal drives are out of reach and `/me` always fails. Get an hour-long token, then call Graph with it: ```sh sp_token() { curl -s -X POST "https://login.microsoftonline.com/$SHAREPOINT_TENANT_ID/oauth2/v2.0/token" \ -d "client_id=$SHAREPOINT_CLIENT_ID" -d "client_secret=$SHAREPOINT_CLIENT_SECRET" \ -d "scope=https://graph.microsoft.com/.default" -d "grant_type=client_credentials" | jq -r '.access_token'; } SP=$(sp_token) # re-run when calls start answering 401 (the token lasts ~1 hour) sp() { local m="$1" p="$2"; shift 2; curl -s -X "$m" -H "Authorization: Bearer $SP" \ -H "Content-Type: application/json" "https://graph.microsoft.com/v1.0/$p" "$@"; } ``` If `sp_token` answers no token, print the body: it comes back as `{error, error_description}` and the description spells the cause out in words, `AADSTS…` code and all — quote it rather than guessing from the short `error` alone. A 403 on a call that looks right is almost always the missing piece from setup: admin consent was never granted, or the app has `Sites.Selected` and nobody granted it this site. Say that rather than "the site does not exist". - Find sites: `sp GET "sites?search=<TERM...