OneDrive (OAuth)

OneDrive (OAuth) node reference - all 89 operations, the credential it needs, and a worked example.

OneDrive and SharePoint document libraries via the Microsoft Graph v1.0 Files API, on a connected Microsoft account.

Credential: Microsoft account - see Credentials.

Delegated permissions

Each operation below lists the delegated permission it needs. Delegated permissions are added to your own Entra app registration under API permissions → Microsoft Graph → Delegated permissions, then consented to when you connect the Microsoft credential. Every permission below is the DELEGATED (work or school account) one, because Pipory's Microsoft credential is an authorization-code flow acting as the signed-in user. Four things this catches people out on. First, the permission named is the one for the DEFAULT /me/drive scope — pointing the same operation at another user's, a group's or a SharePoint site's drive escalates it to the .All variant, which is why the node ships an "OneDrive & SharePoint (all files)" scope preset alongside the plain "OneDrive Files" one; the plain preset grants only Files.ReadWrite and reaches your own OneDrive and nothing else. Second, the SharePoint list plane (document-library metadata columns) is not gated by Files.* at all but by Sites.Read.All / Sites.ReadWrite.All, and creating a list needs Sites.Manage.All. Third, several rows are personal-Microsoft-account only and say so in parentheses rather than naming an Entra checkbox that will never exist — the whole albums-and-bundles plane is one, and Restore from the recycle bin is another (Graph's own page lists delegated work-or-school as "Not supported" there). Fourth, Graph permissions do not nest the way Google's scopes do, and a 403 names nothing: its body says only accessDenied, so the node's error message states the required permission itself. If a run fails with a permission error, the node names the missing delegated permission in the error - grant it and re-run; you do not need to rebuild the workflow.

Operations (89)

Drives

Operation	What it does	Delegated permission
`getDrive`	Get drive	`Files.Read`
`listDrives`	List drives	`Files.Read`
`getDriveRoot`	Get drive root folder	`Files.Read`
`getSpecialFolder`	Get a special folder	`Files.Read`
`listSpecialFolderChildren`	List a special folder's children	`Files.Read`
`listFollowedItems`	List followed items	`Files.Read`
`getDelta`	Track changes (delta)	`Files.Read`
`getDeltaLatestToken`	Get the latest delta token	`Files.Read`
`listDriveActivities`	List drive activities	`Files.Read`

Files & folders — read

Operation	What it does	Delegated permission
`getItem`	Get file or folder	`Files.Read`
`listChildren`	List a folder's children	`Files.Read`
`listFiles`	List files in a folder (by path)	`Files.Read`
`searchDrive`	Search the whole drive	`Files.Read`
`searchFolder`	Search inside a folder	`Files.Read`
`downloadFile`	Download file contents	`Files.Read`
`downloadFileAsFormat`	Download converted (PDF, JPG, HTML, GLB)	`Files.Read`
`listThumbnails`	List thumbnails	`Files.Read`
`getThumbnail`	Get one thumbnail	`Files.Read`
`getItemPreview`	Get a short-lived preview URL	`Files.Read`
`getItemAnalyticsAllTime`	Get all-time analytics	`Files.Read`
`getItemAnalyticsLastSevenDays`	Get last-seven-days analytics	`Files.Read`
`listItemActivities`	List activities on an item	`Files.Read`
`getActivitiesByInterval`	Get activity stats by interval	`Files.Read`
`getItemListItem`	Get the item's SharePoint list entry	`Files.Read`

Files & folders — write

Operation	What it does	Delegated permission
`createFolder`	Create folder	`Files.ReadWrite`
`uploadFile`	Upload file (by path)	`Files.ReadWrite`
`replaceFileContent`	Replace an existing file's contents	`Files.ReadWrite`
`createUploadSession`	Start a large-file upload session	`Files.ReadWrite`
`updateItem`	Rename / update metadata	`Files.ReadWrite`
`moveItem`	Move to another folder	`Files.ReadWrite`
`copyItem`	Copy file or folder	`Files.ReadWrite`
`deleteItem`	Delete (to recycle bin)	`Files.ReadWrite`
`permanentDeleteItem`	Permanently delete	`Files.ReadWrite`
`restoreItem`	Restore from the recycle bin	(delegated work-or-school is not supported by Graph for this endpoint — it needs a personal Microsoft account with Files.ReadWrite.All, or an app-only token)
`followItem`	Follow item	`Files.Read`
`unfollowItem`	Unfollow item	`Files.Read`
`checkOutItem`	Check out	`Files.ReadWrite`
`checkInItem`	Check in	`Files.ReadWrite`
`discardCheckOut`	Discard check-out	`Files.ReadWrite`

Operation	What it does	Delegated permission
`createSharingLink`	Create a sharing link	`Files.ReadWrite`
`inviteToItem`	Share with people (invite)	`Files.ReadWrite`
`listItemPermissions`	List permissions	`Files.Read`
`getItemPermission`	Get permission	`Files.Read`
`createItemPermission`	Create an app permission	`Files.ReadWrite`
`updateItemPermission`	Update permission	`Files.ReadWrite`
`deleteItemPermission`	Remove permission	`Files.ReadWrite`
`grantSharingLinkAccess`	Grant people access to a sharing link	`Files.ReadWrite`
`getSharedItem`	Resolve a sharing link	`Files.ReadWrite`
`getSharedItemDriveItem`	Get the item behind a sharing link	`Files.ReadWrite`
`listSharedItemChildren`	List children behind a sharing link	`Files.ReadWrite`
`downloadSharedItem`	Download the file behind a sharing link	`Files.ReadWrite`

Version history

Operation	What it does	Delegated permission
`listItemVersions`	List versions	`Files.Read`
`getItemVersion`	Get version	`Files.Read`
`downloadItemVersion`	Download a past version	`Files.Read`
`restoreItemVersion`	Restore a past version	`Files.ReadWrite`

Albums & bundles (personal OneDrive)

Operation	What it does	Delegated permission
`listBundles`	List bundles and albums	`Files.Read` (personal Microsoft accounts only)
`getBundle`	Get bundle	`Files.Read` (personal Microsoft accounts only)
`createBundle`	Create a bundle or album	`Files.ReadWrite` (personal Microsoft accounts only)
`updateBundle`	Rename a bundle	`Files.ReadWrite` (personal Microsoft accounts only)
`deleteBundle`	Delete a bundle	`Files.ReadWrite` (personal Microsoft accounts only)
`addItemToBundle`	Add an item to a bundle	`Files.ReadWrite` (personal Microsoft accounts only)
`removeItemFromBundle`	Remove an item from a bundle	`Files.ReadWrite` (personal Microsoft accounts only)

Retention & sensitivity labels

Operation	What it does	Delegated permission
`getRetentionLabel`	Get retention label	`Files.Read.All`
`setRetentionLabel`	Apply a retention label	`Files.Read.All`
`removeRetentionLabel`	Remove the retention label	`Files.ReadWrite.All`
`lockOrUnlockRecord`	Lock or unlock a record	`Files.ReadWrite.All`
`assignSensitivityLabel`	Assign a sensitivity label	`Files.ReadWrite.All`
`extractSensitivityLabels`	Extract sensitivity labels	`Files.Read.All`

SharePoint sites

Operation	What it does	Delegated permission
`getSite`	Get site	`Sites.Read.All`
`getRootSite`	Get the tenant root site	`Sites.Read.All`
`getSiteByPath`	Get site by hostname and path	`Sites.Read.All`
`searchSites`	Search sites	`Sites.Read.All`
`listSubsites`	List subsites	`Sites.Read.All`
`listSiteColumns`	List site columns	`Sites.Read.All`
`listSiteContentTypes`	List site content types	`Sites.Read.All`

SharePoint lists & document-library columns

Operation	What it does	Delegated permission
`listSiteLists`	List a site's lists and libraries	`Sites.Read.All`
`getSiteList`	Get list	`Sites.Read.All`
`createSiteList`	Create list	`Sites.Manage.All`
`listListColumns`	List a list's columns	`Sites.Read.All`
`listListContentTypes`	List a list's content types	`Sites.Read.All`
`listListItems`	List list items	`Sites.Read.All`
`getListItem`	Get list item	`Sites.Read.All`
`createListItem`	Create list item	`Sites.ReadWrite.All`
`updateListItemFields`	Update list item columns	`Sites.ReadWrite.All`
`deleteListItem`	Delete list item	`Sites.ReadWrite.All`
`getListItemDelta`	Track list item changes (delta)	`Sites.Read.All`
`listListItemVersions`	List list item versions	`Sites.Read.All`
`getListItemVersion`	Get list item version	`Sites.Read.All`
`restoreListItemVersion`	Restore a list item version	`Sites.ReadWrite.All`

On this page