What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Access a SharePoint document library through Microsoft Graph by authenticating an app, resolving the SharePoint site, selecting its drive, navigating driveItem resources, and requesting file content. The default library is available at /sites/{siteId}/drive; use /sites/{siteId}/drives when you need to discover other libraries.
How Graph represents SharePoint libraries
Microsoft Graph treats a SharePoint document library as a drive, the top-level file-system container. Files and folders inside it are driveItem resources. A driveItem can be addressed by an ID or by a path, and a folder exposes a children relationship for listing its contents.
The examples below use the production https://graph.microsoft.com/v1.0 endpoint. Obtain a bearer token from your Microsoft identity application before making any request.
Choose the right permission model
Select permissions according to both the endpoint and the identity flow. Delegated access runs as a signed-in work or school user; application access runs as the app without a user. The least-privileged read permissions documented for the operations in this guide are:
#1 Best Overall
| Operation | Delegated work or school | Application |
|---|---|---|
| Resolve a site by hostname and path | Sites.Read.All |
Sites.Read.All |
| Read driveItem metadata | Files.Read |
Files.Read.All |
| List folder children | Files.Read |
Files.Read.All |
| Download file content | Files.Read |
Files.Read.All |
These are least-privileged starting points, not a guarantee that a request will succeed in your tenant. An administrator may need to grant consent, and the user or application must have access to the target SharePoint site and library. Do not infer item authorization merely because Graph can resolve the site. Write or permission-management operations require a separate review and broader permissions where appropriate.
SharePoint Embedded has additional container permissions such as FileStorageContainer.Selected. Do not add those permissions to an ordinary SharePoint Online library unless your application actually uses SharePoint Embedded.
Step 1: Resolve the SharePoint site
If you already know the Graph site ID, skip to the next section. Otherwise, resolve the site with its tenant hostname and server-relative path:
GET https://graph.microsoft.com/v1.0/sites/{hostname}:/{relative-path}
Authorization: Bearer ACCESS_TOKENFor example, a site at https://contoso.sharepoint.com/sites/engineering uses contoso.sharepoint.com as the hostname and sites/engineering as the relative path:
GET https://graph.microsoft.com/v1.0/sites/contoso.sharepoint.com:/sites/engineering
Authorization: Bearer ACCESS_TOKENThe response includes the site’s id. Keep that value; subsequent calls use it instead of the human-readable URL. URL-encode unusual path characters and preserve the slash structure of the server-relative path.
Step 2: Select the document library
Use the default library
When the target is the site’s default document library, request:
GET https://graph.microsoft.com/v1.0/sites/{siteId}/drive
Authorization: Bearer ACCESS_TOKENThe returned drive object contains the library’s id, name, and other metadata.
Discover every library
A site can contain multiple document libraries. Enumerate them instead of assuming that /drive is the desired one:
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →GET https://graph.microsoft.com/v1.0/sites/{siteId}/drives
Authorization: Bearer ACCESS_TOKENChoose the drive whose returned metadata identifies the intended library, then retain its id for item operations. The default-drive route and the collection route are different choices: the first is convenient when the library is known; the second is required for discovery or non-default libraries.
Step 3: Address files and folders
Get the root item
The root of a drive can be read with:
GET https://graph.microsoft.com/v1.0/drives/{driveId}/root
Authorization: Bearer ACCESS_TOKENYou can also use the site route for the default drive:
GET https://graph.microsoft.com/v1.0/sites/{siteId}/drive/root
Authorization: Bearer ACCESS_TOKENUse an item ID
Once you know an item’s ID, retrieve its metadata with:
GET https://graph.microsoft.com/v1.0/drives/{driveId}/items/{itemId}
Authorization: Bearer ACCESS_TOKENUse a path
For a known path, Graph supports a colon-delimited path form. For the default site drive:
Free tools Windows power users keep installed
One-click scans. No signup required.
GET https://graph.microsoft.com/v1.0/sites/{siteId}/drive/root:/Reports/2026/summary.xlsx
Authorization: Bearer ACCESS_TOKENEncode reserved URL characters in folder and file names. A path is convenient for stable, human-known locations; IDs are safer when names can change or contain ambiguous characters.
Step 4: List a folder’s contents
First obtain the folder’s driveItem ID, then request its children:
GET https://graph.microsoft.com/v1.0/drives/{driveId}/items/{folderItemId}/children
Authorization: Bearer ACCESS_TOKENEach returned item may represent a file, folder, or another supported item type. Inspect the presence of the item’s file or folder facet rather than assuming every child is downloadable. Collection responses can be paged. If Graph returns an @odata.nextLink, request that URL exactly until it is absent; do not manufacture your own continuation URL.
Step 5: Download file bytes
Download a file’s primary content stream with:
GET https://graph.microsoft.com/v1.0/sites/{siteId}/drive/items/{itemId}/content
Authorization: Bearer ACCESS_TOKENGraph may respond with a redirect to the content location. Use an HTTP client that follows redirects, and write the response as binary data. Metadata and content are separate requests: a successful item lookup does not itself return the file bytes.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsComplete Python example
The following example resolves a site, finds a named library, lists its root, and downloads one file. Supply an already-issued access token with the permissions required by your flow.
import requests
from pathlib import Path
GRAPH = "https://graph.microsoft.com/v1.0"
TOKEN = "ACCESS_TOKEN"
HOST = "contoso.sharepoint.com"
SITE_PATH = "sites/engineering"
LIBRARY_NAME = "Project Documents"
FILE_NAME = "Reports/2026/summary.xlsx"
headers = {"Authorization": f"Bearer {TOKEN}"}
def get(url, **kwargs):
response = requests.get(url, headers=headers, timeout=60, **kwargs)
response.raise_for_status()
return response
site = get(f"{GRAPH}/sites/{HOST}:/{SITE_PATH}").json()
site_id = site["id"]
drives = get(f"{GRAPH}/sites/{site_id}/drives").json()["value"]
drive = next((d for d in drives if d.get("name") == LIBRARY_NAME), None)
if drive is None:
raise RuntimeError(f"Library not found: {LIBRARY_NAME}")
drive_id = drive["id"]
root = get(f"{GRAPH}/drives/{drive_id}/root").json()
children = get(f"{GRAPH}/drives/{drive_id}/items/{root['id']}/children").json()
for item in children.get("value", []):
print(item["name"], item["id"])
item = get(
f"{GRAPH}/drives/{drive_id}/root:/{FILE_NAME}"
).json()
content = requests.get(
f"{GRAPH}/drives/{drive_id}/items/{item['id']}/content",
headers=headers,
timeout=120,
)
content.raise_for_status()
Path("summary.xlsx").write_bytes(content.content)
For production code, add retry handling for transient HTTP failures, preserve the @odata.nextLink loop for every collection, and avoid logging access tokens or downloaded sensitive data.
Equivalent cURL requests
Resolve the site
curl -H "Authorization: Bearer ACCESS_TOKEN"
"https://graph.microsoft.com/v1.0/sites/contoso.sharepoint.com:/sites/engineering"List libraries
curl -H "Authorization: Bearer ACCESS_TOKEN"
"https://graph.microsoft.com/v1.0/sites/SITE_ID/drives"Download an item
curl -L -H "Authorization: Bearer ACCESS_TOKEN"
-o summary.xlsx
"https://graph.microsoft.com/v1.0/sites/SITE_ID/drive/items/ITEM_ID/content"Equivalent Node.js example
const graph = 'https://graph.microsoft.com/v1.0';
const token = process.env.ACCESS_TOKEN;
const headers = { Authorization: `Bearer ${token}` };
const site = await fetch(
`${graph}/sites/contoso.sharepoint.com:/sites/engineering`,
{ headers }
).then(r => {
if (!r.ok) throw new Error(`Site lookup failed: ${r.status}`);
return r.json();
});
const drives = await fetch(`${graph}/sites/${site.id}/drives`, { headers })
.then(r => r.json());
const drive = drives.value.find(d => d.name === 'Project Documents');
if (!drive) throw new Error('Library not found');
const item = await fetch(
`${graph}/drives/${drive.id}/root:/Reports/2026/summary.xlsx`,
{ headers }
).then(r => r.json());
const fileResponse = await fetch(
`${graph}/drives/${drive.id}/items/${item.id}/content`,
{ headers, redirect: 'follow' }
);
if (!fileResponse.ok) throw new Error(`Download failed: ${fileResponse.status}`);
const bytes = Buffer.from(await fileResponse.arrayBuffer());
require('node:fs').writeFileSync('summary.xlsx', bytes);
Troubleshooting common failures
401 Unauthorized
The bearer token is missing, expired, malformed, or intended for another resource. Acquire a token for Microsoft Graph, send it as Authorization: Bearer ..., and verify that the token’s audience and consent match the application flow.
403 Forbidden
The identity is authenticated but lacks the required permission or SharePoint access. Check delegated versus application permissions, administrator consent, and the user’s or app’s access to the specific site. A site lookup succeeding does not prove item access.
Best Value
404 Not Found
Confirm the hostname, server-relative path, site ID, drive ID, item ID, and capitalization or encoding of a path. A request to /drive can also be valid while pointing at the default library rather than the library you intended.
Library list is incomplete
Follow @odata.nextLink when Graph paginates the /drives or /children collection. Do not stop after the first response page.
Folder download fails
The /content endpoint is for a file. Inspect the item metadata and use /children to enumerate a folder.
Path names containing spaces or symbols fail
URL-encode the path components while retaining Graph’s colon and slash delimiters. When paths are mutable or difficult to encode, resolve the item once and use its ID thereafter.
Reliability, performance and security considerations
- Cache stable site and drive IDs instead of resolving names on every request, but refresh them when administrators can rename or move resources.
- Use bounded timeouts, retry transient failures with backoff, and honor Graph responses rather than issuing uncontrolled parallel requests.
- Stream large downloads to disk or object storage instead of holding all bytes in memory.
- Request read-only scopes for read-only jobs. Keep application permissions narrowly governed because they run without a signed-in user’s interactive context.
- Protect tokens, file contents and diagnostic logs. Redact authorization headers and personal or confidential metadata.
- For recurring synchronization, persist item IDs and metadata and handle renamed paths by ID where possible.
Or skip the browser setup
If your actual task is producing a clean image of a SharePoint page or another URL rather than reading library files, ScreenshotNeo provides a single-call website screenshot API. It accepts cookie or consent banners as a visitor and removes more than 60 known consent platforms, newsletter popups and chat widgets before capture. Bot checks, blank pages, timeouts, failed loads and cache hits are not billed, and each response identifies the page verdict and billing status.
With an API key, the cURL call is:
curl -G "https://api.screenshotneo.com/v1/shot" -d access_key=YOUR_API_KEY --data-urlencode url=https://stripe.com -o shot.webpSee the ScreenshotNeo documentation for all capture options, including full-page and element captures, device and retina settings, PDFs, custom CSS and JavaScript, waits, request blocking, cookies, headers, geolocation, caching, signed links, asynchronous jobs, bulk capture and usage information. ScreenshotNeo also provides an MCP server with take_screenshot, get_page_info and capture_pdf tools for Claude, Cursor and other MCP clients. The Free plan includes 1,000 screenshots each month with no card; paid plans start at $5 for 3,000. Create a free ScreenshotNeo account.
Frequently Asked Questions
Can I use a SharePoint URL instead of a site ID for every request?
Use the hostname-and-relative-path lookup to obtain the site ID, then prefer IDs for repeat operations. Path addressing remains useful for locating a known item.
Does listing a drive grant permission to its files?
No. Listing metadata and reading content still depend on the token’s permissions and the identity’s access to that site and library.
Should a daemon use delegated or application permissions?
Use delegated access when a signed-in user is part of the operation; use application access for unattended jobs, subject to tenant consent and governance.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
