To access a SharePoint document library with Microsoft Graph, first identify the site, then address its library as a Graph drive. Use /sites/{siteId}/drive for the default library or /sites/{siteId}/drives to find another library. From there, use driveItem endpoints to locate folders, list their contents, retrieve metadata, or download file bytes. Each request needs a valid Microsoft Graph bearer token and permissions appropriate to the identity flow and operation.
How Graph represents SharePoint sites, libraries, and files
Microsoft Graph treats a SharePoint document library as a drive, the top-level container for a file system. Individual files and folders are driveItem resources. As Microsoft’s drive documentation puts it, “A Drive is the top-level container for a file system, such as OneDrive or SharePoint document libraries.” Its driveItem documentation says, “All file system objects in OneDrive and SharePoint are returned as driveItem resources.”
This distinction determines the request sequence: resolve the SharePoint site, choose the drive (library), then address a file or folder within that drive. A site can have multiple libraries, so the default drive route is not a substitute for library discovery.
What you need before making a request
- A Microsoft Entra application or another supported identity setup that can obtain a Microsoft Graph access token.
- The SharePoint hostname and server-relative site path, or the site ID.
- The appropriate Graph permission and any tenant consent or resource access your configuration requires.
- The Graph API base URL:
https://graph.microsoft.com/v1.0for the production requests below.
Examples use a bearer token represented as $TOKEN. Obtain that token through your chosen delegated or application authentication flow; the exact setup depends on your app and tenant. Do not put a client secret in a browser app or source-controlled script. A successful site lookup does not by itself prove that the caller can read every library item.
#1 Best Overall
1. Resolve the SharePoint site
If you know the tenant hostname and the site’s server-relative path, use the site-by-path endpoint:
GET https://graph.microsoft.com/v1.0/sites/{hostname}:/{relative-path}
For example, for a site at https://contoso.sharepoint.com/sites/Finance, request:
GET https://graph.microsoft.com/v1.0/sites/contoso.sharepoint.com:/sites/Finance
Send the access token in the Authorization header. The returned site resource includes an id; save it for subsequent requests. The path is relative to the hostname, not a full URL placed after the colon. Microsoft documents Sites.Read.All as the least-privileged permission for this lookup for both work or school delegated access and application access. See Get a site by path.
2. Select the document library
Use the default library
If the intended library is the site’s default document library, request:
GET https://graph.microsoft.com/v1.0/sites/{siteId}/drive
The response identifies the drive. Retain its id if you want to use drive-based item routes. Endpoint details are in Get a drive.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsDiscover or choose another library
If the site has multiple libraries, or you do not know which one is the target, enumerate them:
GET https://graph.microsoft.com/v1.0/sites/{siteId}/drives
Inspect the returned drive names and IDs, then select the intended library. Do not assume that the first result is the right one. See List drives.
| Need | Request | Use it when |
|---|---|---|
| Get the default library | /sites/{siteId}/drive |
You already know the default library is the target. |
| Find libraries on a site | /sites/{siteId}/drives |
The target is not the default, or you need to discover available libraries. |
3. Find a file or folder
You can address a drive item by ID or path. For example, to get metadata for a path under the default drive’s root, use:
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →GET https://graph.microsoft.com/v1.0/sites/{siteId}/drive/root:/{item-path}
Replace {item-path} with the path inside the library, such as Reports/Annual.xlsx. For a non-default library, use its drive ID in a drive-based route, for example /drives/{driveId}/root:/{item-path}. Encode path characters as required for a URL; do not treat a path containing spaces or reserved characters as already URL-safe.
To retrieve metadata for a known item ID in the default drive, request:
GET https://graph.microsoft.com/v1.0/sites/{siteId}/drive/items/{itemId}
Recommended Free Tools
The response is a driveItem. It can represent a file or folder, and its properties can help you decide what to do next. For supported item addressing and metadata routes, see Get driveItem.
4. List the contents of a folder
Once you have a folder’s item ID, list its children. For the default drive, the route is:
GET https://graph.microsoft.com/v1.0/sites/{siteId}/drive/items/{folderItemId}/children
For a selected non-default library, use its drive ID:
GET https://graph.microsoft.com/v1.0/drives/{driveId}/items/{folderItemId}/children
Each returned child is a driveItem. Check whether the item has a folder facet or a file facet before applying folder or download logic. If Graph returns an @odata.nextLink, follow that URL to retrieve the next page; do not assume one response contains every child. The list-children endpoint and its permissions are documented at List children of a driveItem.
5. Download file content
To retrieve the file’s primary byte stream, use the content endpoint with the item ID:
GET https://graph.microsoft.com/v1.0/sites/{siteId}/drive/items/{itemId}/content
Free tools Windows power users keep installed
One-click scans. No signup required.
For a file in a non-default library, use /drives/{driveId}/items/{itemId}/content. This is a content download, distinct from the metadata request. Your HTTP client should handle the response as bytes and account for the redirect behavior used to deliver file content rather than trying to parse the body as JSON. See Download driveItem content.
Which permissions should you request?
Permission selection depends on whether the app acts for a signed-in user (delegated) or runs as an application, and on the endpoint being called. The least-privileged permissions listed in the endpoint references are:
| Operation | Delegated work or school | Application |
|---|---|---|
| Resolve site by path | Sites.Read.All |
Sites.Read.All |
| Read driveItem metadata | Files.Read |
Files.Read.All |
| List folder children | Files.Read |
Files.Read.All |
| Download file content | Files.Read |
Files.Read.All |
These are least-privileged scopes documented for the respective operations, not a guarantee that a particular tenant has granted the application access to the target resource. Use read scopes for a read-only workflow, request broader permissions only when the app’s actual operations require them, and verify consent and site access in the tenant. Microsoft’s endpoint-specific permission tables are available in the linked documentation above. Some endpoints also note additional permission requirements for SharePoint Embedded; those apply to that distinct product scenario, not automatically to an ordinary SharePoint Online document library.
Runnable request examples
The following cURL sequence shows site lookup, library discovery, folder listing, and downloading a known item. Set the hostname, relative path, IDs, and token for your environment. The site and drive requests return JSON; the content request writes bytes to a file.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →export TOKEN='YOUR_ACCESS_TOKEN'
export HOST='contoso.sharepoint.com'
export SITE_PATH='/sites/Finance'
curl -sS -H "Authorization: Bearer $TOKEN" "https://graph.microsoft.com/v1.0/sites/$HOST:$SITE_PATH"
Copy the returned site id, then enumerate the libraries:
export SITE_ID='YOUR_SITE_ID'
curl -sS -H "Authorization: Bearer $TOKEN" "https://graph.microsoft.com/v1.0/sites/$SITE_ID/drives"
After selecting a drive and obtaining the folder item ID, list children:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Best Value
export DRIVE_ID='YOUR_DRIVE_ID'
export FOLDER_ID='YOUR_FOLDER_ITEM_ID'
curl -sS -H "Authorization: Bearer $TOKEN" "https://graph.microsoft.com/v1.0/drives/$DRIVE_ID/items/$FOLDER_ID/children"
Download a file by item ID:
export ITEM_ID='YOUR_FILE_ITEM_ID'
curl -L -sS -H "Authorization: Bearer $TOKEN" "https://graph.microsoft.com/v1.0/drives/$DRIVE_ID/items/$ITEM_ID/content" -o downloaded-file
The -L option follows redirects that may be part of the content download. Keep the token and any resulting download URL private.
Or skip the browser setup
Graph is the route for SharePoint libraries. If your task is instead to capture a web page as an image or PDF, ScreenshotNeo is a website screenshot API and MCP server; it does not replace Graph or grant access to SharePoint files. A single request can capture a URL:
curl -G "https://api.screenshotneo.com/v1/shot" -d access_key=YOUR_API_KEY --data-urlencode url=https://stripe.com -o shot.webp
See the ScreenshotNeo API documentation for request options. Before a screenshot, it accepts cookie or consent banners like a visitor and removes more than 60 known consent platforms, newsletter popups, and chat widgets; each step can be turned off. Bot checks or CAPTCHAs, blank pages, timeouts, failed loads, and cache hits are not billed, with the outcome indicated in response headers. Its MCP server provides take_screenshot, get_page_info, and capture_pdf tools for AI agents. The Free plan includes 1,000 shots per month without a card; paid plans start at $5 for 3,000 shots. Sign up for free and get 1,000 screenshots a month with no card.
Troubleshooting common Graph errors
401 Unauthorized
The request is missing a usable access token, the token is expired, or it was issued for a different audience. Obtain a current token for Microsoft Graph and send it as Authorization: Bearer {token}.
403 Forbidden
The caller may lack the permission required by that operation, required consent may not have been granted, or the identity may not have access to the target resource under tenant policy. Check the endpoint’s delegated or application permission table, confirm the token’s granted permissions, and have the tenant administrator verify resource access. Do not infer item access from a successful site lookup.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstall404 Not Found
Check that the hostname and server-relative path identify the site, that the site ID is copied intact, and that the drive or item ID belongs to the site or drive you are querying. If a library is not the default, discover it with /drives rather than assuming /drive points to it.
Path lookup fails for a known site
Use the tenant hostname followed by a colon and the site-relative path, not a full URL in the path portion. Ensure the path begins with the correct site segment and URL-encode characters that require encoding.
Folder listing omits expected items
Inspect whether the response contains @odata.nextLink and request subsequent pages. Confirm that the folder ID is the intended folder and that the caller can see the items.
A content response is not JSON
The /content route returns file bytes, not item metadata. Write the response body to a binary file; use a separate driveItem metadata request when you need names or other properties.
Quick Recap
Reliability and implementation notes
- Use Graph
v1.0for the production requests shown here. Microsoft describes its beta APIs as subject to change and unsupported for production applications. - Keep site IDs, drive IDs, and item IDs from Graph responses rather than rebuilding them from display names.
- Separate discovery from access: resolve the site and library, then use the correct identity and permission for each read operation.
- When listing large folders, follow pagination links until the collection is complete. Handle HTTP errors explicitly and avoid logging bearer tokens or private file content.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
