SharePoint

Overview

The SharePoint integration provides full CRUD operations over SharePoint resources via Microsoft Graph API. It supports:

• Sites: Search and discover SharePoint sites
• Files: List, read, upload, update, delete files in document libraries
• Lists: CRUD operations on SharePoint lists and list items
• Streaming Downloads: Zero-copy proxy streaming for file downloads

All operations use the existing Microsoft 365 OAuth flow. No separate consent is required.

Prerequisites

1. Microsoft 365 integration must be active for your tenant
2. The following OAuth scopes must be authorized:
   • Files.ReadWrite.All — File CRUD on document libraries
   • Sites.Read.All — Site discovery and enumeration
   • Sites.ReadWrite.All — List item operations and metadata

If you authorized before these scopes were added, you'll receive a 407 response with an auth_url on your first SharePoint call. Visit the URL to re-authorize with the new permissions.

API Reference

Sites

Method	Path	Description
GET	/microsoft365/sharepoint/sites	Search and list SharePoint sites
GET	/microsoft365/sharepoint/sites/{site_id}	Get a specific site by ID
GET	/microsoft365/sharepoint/sites/{site_id}/drives	List document libraries

Search sites

curl -X GET "https://api.yourdomain.com/microsoft365/sharepoint/sites?search=projects" \
  -H "Access-Token: <token>"

Get site by ID

curl -X GET "https://api.yourdomain.com/microsoft365/sharepoint/sites/{site_id}" \
  -H "Access-Token: <token>"

List document libraries

curl -X GET "https://api.yourdomain.com/microsoft365/sharepoint/sites/{site_id}/drives" \
  -H "Access-Token: <token>"

Files

Method	Path	Description
GET	/microsoft365/sharepoint/sites/{site_id}/drives/{drive_id}/items	List files/folders
GET	.../items/{item_id}	Get file metadata
GET	.../items/{item_id}/content	Download file (streaming)
PUT	.../items/{parent_id}/children/{filename}	Upload file
PATCH	.../items/{item_id}	Update/rename file
DELETE	.../items/{item_id}	Delete file
POST	.../folders	Create folder

List files in a document library

curl -X GET "https://api.yourdomain.com/microsoft365/sharepoint/sites/{site_id}/drives/{drive_id}/items" \
  -H "Access-Token: <token>"

Download a file (streaming)

The download endpoint returns a StreamingResponse — the file bytes are piped directly from Microsoft Graph without buffering in memory.

curl -X GET "https://api.yourdomain.com/microsoft365/sharepoint/sites/{site_id}/drives/{drive_id}/items/{item_id}/content" \
  -H "Access-Token: <token>" \
  -o downloaded-file.pdf

Memory guarantee: Regardless of file size (1KB or 2GB), the download uses ~65KB of Python memory (httpx internal buffer only).

Upload a file

curl -X PUT "https://api.yourdomain.com/microsoft365/sharepoint/sites/{site_id}/drives/{drive_id}/items/{parent_id}/children/document.pdf" \
  -H "Access-Token: <token>" \
  -H "Content-Type: application/octet-stream" \
  --data-binary @document.pdf

Size limit: 25MB per upload. For larger files, use Microsoft Graph's chunked upload session API directly.

Create a folder

curl -X POST "https://api.yourdomain.com/microsoft365/sharepoint/sites/{site_id}/drives/{drive_id}/folders" \
  -H "Access-Token: <token>" \
  -H "Content-Type: application/json" \
  -d '{"parent_path": "/Documents", "folder_name": "NewFolder"}'

Lists

Method	Path	Description
GET	/microsoft365/sharepoint/sites/{site_id}/lists	List SharePoint lists
GET	.../lists/{list_id}/items	List items in a list
GET	.../lists/{list_id}/items/{item_id}	Get a list item
POST	.../lists/{list_id}/items	Create a list item
PATCH	.../lists/{list_id}/items/{item_id}	Update a list item
DELETE	.../lists/{list_id}/items/{item_id}	Delete a list item

List items in a SharePoint list

curl -X GET "https://api.yourdomain.com/microsoft365/sharepoint/sites/{site_id}/lists/{list_id}/items" \
  -H "Access-Token: <token>"

Create a list item

curl -X POST "https://api.yourdomain.com/microsoft365/sharepoint/sites/{site_id}/lists/{list_id}/items" \
  -H "Access-Token: <token>" \
  -H "Content-Type: application/json" \
  -d '{"fields": {"Title": "New Task", "Status": "Not Started"}}'

Update a list item

curl -X PATCH "https://api.yourdomain.com/microsoft365/sharepoint/sites/{site_id}/lists/{list_id}/items/{item_id}" \
  -H "Access-Token: <token>" \
  -H "Content-Type: application/json" \
  -d '{"fields": {"Status": "Completed"}}'

Streaming Downloads Architecture

The SharePoint download endpoint (GET .../items/{item_id}/content) uses zero-copy proxy streaming:

Microsoft Graph API
    │  GET /sites/{id}/drive/items/{item}/content
    ▼
httpx AsyncClient (shared connection pool)
    │  client.stream("GET", url, headers=headers)
    ▼
SharePointBase._stream_binary()
    │  yields bytes chunks one at a time
    │  enforces byte limit mid-stream
    ▼
FastAPI StreamingResponse
    │  pipes chunks directly to client TCP socket
    ▼
Client receives attachment download

Safety Guarantees

Scenario	Memory Cost	Why Safe
2KB text file	~65KB	httpx internal buffer only
100MB PDF	~65KB	Streaming, never assembled
2GB video	~65KB	Streaming, never assembled
Malicious oversized file	413 error	Rejected at Content-Length check
Missing Content-Length	413 error	Runtime byte counter catches it

Error Handling During Streams

• 401 mid-stream: Token refresh attempted once, retry on success
• 403 (InsufficientPermissions): Returns 407 with re-auth URL
• File exceeds 100MB: Returns 413 with size limit message

Error Reference

HTTP	Condition	Meaning
400	Invalid OData	Bad filter/select/orderby parameter
401	Missing token	No Access-Token header
403	Insufficient permissions	Re-authorize with SharePoint scopes
404	Resource not found	Site/drive/file/list doesn't exist
407	OAuth required	Token expired or new scopes needed
413	File too large	Upload >25MB or download >100MB
429	Rate limited	Too many requests, retry after backoff

OAuth Re-Consent Flow

If you authorized Microsoft 365 before the SharePoint scopes were added:

1. Call any SharePoint endpoint
2. Receive 407 response with auth_url
3. Visit auth_url to complete the consent screen
4. The new scopes (Files.ReadWrite.All, Sites.Read.All, Sites.ReadWrite.All) will be granted
5. Retry your original SharePoint call

MCP Tools

SharePoint is also available via MCP tools with the following naming convention:

Tool	Description
sharepointsite:list	Search and list SharePoint sites
sharepointsite:read	Get a SharePoint site by ID
sharepointdrive:list	List document libraries
sharepointfile:list	List files in a document library
sharepointfile:read	Get file metadata
sharepointfile:download	Download a file (base64-encoded)
sharepointfile:create	Upload a file
sharepointfile:update	Update/rename a file
sharepointfile:delete	Delete a file
sharepointfile:mkdir	Create a folder
sharepointlist:list	List SharePoint lists
sharepointitem:list	List items in a list
sharepointitem:read	Get a list item
sharepointitem:create	Create a list item
sharepointitem:update	Update a list item
sharepointitem:delete	Delete a list item

---

See also: Microsoft 365