Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →For an ordinary SharePoint list attachment, do not mistake the SharePoint REST example in the original Part 7 tutorial for a Microsoft Graph request. Graph documents how to read list-item metadata, but the Microsoft documentation cited here does not establish a complete Graph v1.0 workflow for downloading attachments from ordinary list items. First identify whether you have a custom-list attachment or a document-library file; the correct API route depends on that distinction.
Why the API distinction matters
Constantin Kwiatkowski’s January 30, 2025, Part 7 tutorial demonstrates retrieving attachments from SharePoint lists with a SharePoint REST request. Its example uses a tenant SharePoint URL and an _api/web/lists/.../AttachmentFiles route, then downloads a file using a SharePoint-relative path. That is SharePoint REST, not Microsoft Graph. Read the Part 7 example on DZone.
Microsoft Graph and SharePoint REST are separate API surfaces. A Graph token or Graph route should not be assumed to work with a SharePoint REST URL, or vice versa. Nor does Graph’s ability to return list items prove that the same endpoint returns an attachment’s bytes.
Identify what the SharePoint item represents
| Resource | What it represents | What the documented Graph material establishes |
|---|---|---|
| Ordinary list item with an attachment | A record in a SharePoint list with a file attached to it. | Graph documents list-item metadata and item listing. The cited documentation does not establish a complete attachment enumeration and download workflow for ordinary list items. |
| Document-library file | A file stored as an item in a SharePoint document library. | Microsoft documents that a document-library item can be represented as a listItem and has a relationship to a driveItem. See the Graph listItem resource. |
That distinction prevents a common dead end: treating a document-library file’s Graph representation as proof that a custom-list attachment has the same retrieval path.
#1 Best Overall
What Microsoft Graph can do for list-item metadata
Read one item
Microsoft Graph v1.0 documents this route for an individual list item:
GET /sites/{site-id}/lists/{list-id}/items/{item-id}
The request can expand the item’s fields and select particular field values. For this documented read operation, Microsoft lists Sites.Read.All as the least-privileged permission for delegated work or school accounts and for application access. The app must also have the necessary consent, and the caller must have access under the tenant’s SharePoint conditions. See Microsoft’s Get listItem reference.
Enumerate items to check listing and fields
To list items, Graph documents:
GET /sites/{site-id}/lists/{list-id}/items
The list operation supports field expansion and OData filtering, and its reference also lists Sites.Read.All as the least-privileged permission. It is useful for checking whether the expected item and metadata are visible through Graph; it is not evidence that an attachment’s file contents are available from this route. Details are in Microsoft’s List items reference.
Why a Graph request may return 403 Access denied
A 403 is a symptom, not a diagnosis. Check these items in order:
- Confirm the host and route. Is the request going to Microsoft Graph or to the SharePoint REST
_apiendpoint? The Part 7 attachment example is SharePoint REST. - Check the token audience. The token must be intended for the API host receiving the request. A token for one API should not be presumed valid for the other.
- Check permission type and consent. Confirm whether the integration uses delegated or application access, and whether the required permission has been granted for the operation.
- Check the caller’s SharePoint access. Application permissions and consent do not, by themselves, establish that every requested resource is accessible under the tenant’s SharePoint access conditions.
- Check content approval. Microsoft notes that application permission
Sites.Manage.Allis required when content approval is enabled on a list and the requested item’s approval status is not Approved.
For a documented list-item read, Sites.Read.All is the least-privileged permission in Microsoft’s endpoint reference; the content-approval condition is a specific exception, not a general reason to grant broader access pre-emptively. See the Get listItem permissions and notes.
Inspect item permissions when access is unclear
Graph also documents a list-item permissions resource at /sites/{site-id}/lists/{list-id}/items/{item-id}/permissions. Microsoft lists Sites.Read.All as least privileged for reading those permission objects. This can help investigate access to the item, but it does not confirm that a separate attachment-content request will succeed. See List permissions on a listItem.
Quick Recap
Best Value
Choose a next step without guessing an attachment endpoint
- If the target is an ordinary list attachment and you are following the Part 7 example, treat it as a SharePoint REST workflow and verify its SharePoint REST authentication and access requirements in your environment.
- If you need Graph for metadata, use the documented site/list/item routes to identify or inspect the item, and troubleshoot authorization against the specific Graph operation.
- If the target is a document-library file, follow the Graph documentation for the document-library
driveItemrelationship rather than assuming it is an ordinary list attachment. - Before implementing a Graph attachment download for a particular list type, verify that Microsoft currently documents the exact endpoint and content workflow for that resource. The cited v1.0 references do not establish a universal route for ordinary list-item attachments.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
