Access token validation failure - MS Graph API Version 2

Question

I had googled a lot on this issue yet nothing helped me. I had seen many similar post also but no useful.

I am using MS Graph API V2 to access user emails,calendar and contacts data.

Authorize URL:

https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=ABC&redirect_uri=redirectURL&response_type=code&scope=Mail.Read(ScopeURL)

Token Request URL:

https://login.microsoftonline.com/common/oauth2/v2.0/token

Headers:

Content-Type:application/x-www-url-form-urlencoded

Body: 

client_id:ABC
redirect_uri:RedirectURL
grant_type:authorization_code
client_secret:KEY
code: pasted from browser URL

I am successfully getting code in browser URL after signing in and using same code to get access token also.

User Profile/Mail Messages/Contacts Request:

Ex: I am trying to read user profile as well user mail messages.

Respective Requests:

Profile: https://graph.microsoft.com/v1.0/me/

Mail Messages: https://graph.microsoft.com/v1.0/me/messages

Header: Authorization:Bearer (AccessToken pasted from token request)

But I am getting below error whichever request in above using.

{
    "error": {
        "code": "InvalidAuthenticationToken",
        "message": "Access token validation failure.",
        "innerError": {
            "request-id": "1e232525-6772-483e-87e3-679d5fcb8fb5",
            "date": "2019-02-22T11:53:50"
        }
    }
}

I had set permissions for mail read and write , access calendars data, contacts ( Full access)

I created application in https://apps.dev.microsoft.com

You would make your life easier by using the MSAL library to do the OAuth flow for you. There are plenty of steps where you can go wrong. If you really don't want to do that, one thing I would suggest trying is to prefix your scopes with graph.microsoft.com — Darrel Miller
– Darrel Miller, Commented Feb 24, 2019 at 21:49
Yes i used scope as like you mentioned, its worked for me. Thanks. But i created app in "apps.dev.microsoft.com" and created scopes manually and used specific scope url. Ex: api://<APPID>/Mail.Read. Is this causing issue for me? will it wont work? what is wrong in this? — PavanKumar GVVS
– PavanKumar GVVS, Commented Feb 25, 2019 at 5:22
How ever, I am not able to get "me/contacts" data from API even though i set permissions.What could be reason. Error: Resource not found — PavanKumar GVVS
– PavanKumar GVVS, Commented Mar 3, 2019 at 7:41

SunnySun · Accepted Answer · 2019-03-05 06:07:37Z

1

The scope format should be https://graph.microsoft.com/Mail.Read Mail.ReadWrite User.Read. I tried the following, it worked.

To get me/contacts, you need to grant the Contacts.Read and Contacts.ReadWrtie permissions.

And when you required the access_token, the authorization URL should like this: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?(need to use the common to replace the tenant name).

edited Mar 5, 2019 at 6:07

answered Feb 25, 2019 at 1:58

SunnySun

1,9311 gold badge9 silver badges9 bronze badges

Sign up to request clarification or add additional context in comments.

5 Comments

PavanKumar GVVS Over a year ago

Yes i used scope as like you mentioned, its worked for me. Thanks. But i created app in "apps.dev.microsoft.com" and created scopes manually and used specific scope url. Ex: api://<APPID>/Mail.Read. Is this causing issue for me? will it wont work? what is wrong in this?

SunnySun Over a year ago

Yes. Expose API means you set up your app as an api, the url is your app not the ms graph api.

SunnySun Over a year ago

If it is useful for you, please help make a mark for this, thanks.

PavanKumar GVVS Over a year ago

I am not able to get "me/contacts" data from API even though i set permissions.What could be reason. Error: Resource not found

SunnySun Over a year ago

@PavanKumarGVVS. I already update my answer, please have a look. thanks.

Collectives™ on Stack Overflow

Access token validation failure - MS Graph API Version 2

1 Answer 1

5 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

5 Comments

Your Answer

Sign up or log in

Post as a guest

Related