Microsoft OneDrive & SharePoint Tool

Browse OneDrive and SharePoint sites, document libraries, folders and file metadata. For finding a document, auditing what is in a library, or checking file sizes and modification dates.

Tool ID

msgraph-files

Credential Required

Yes — the shared msgraph credential, owned by the msgraph connector. Configure the tenant once and all nine tools use it; rotating the client secret is one edit rather than nine.

It is a server-managed OAuth credential: InTouch mints and refreshes the access token itself and the connector never sees the secret. For unattended work set grant_type to client_credentials (the app-only grant) — an app-only token belongs to the application, so a 06:00 schedule does not run as a person, see only what that person can see, and stop working the day they leave.

Credential Properties

Entra setup

1. https://entra.microsoft.com → App registrations → your app → API permissions.
2. Add a permission → Microsoft Graph → Application permissions — not Delegated. Picking Delegated is the most common failure: it consents cleanly and then 403s at runtime.
3. Tick the permissions listed under Permissions below, then Grant admin consent. The Status column must read Granted.
4. Permissions live in the token, not the portal. A token minted before the grant carries the old claims for about an hour — blank access_token to force a fresh mint.

Permissions

Files.Read.All and Sites.Read.All.

Operations

1. get_user_drive — Get a user's OneDrive

One person's OneDrive, and its driveId. Calls GET /users/{id}/drive.

Properties:

Published Outputs: - result — the JSON response body - status — HTTP status code

2. list_sites — List SharePoint sites

Sites matching a search term. Requires {"search": "*"} or a name fragment in query. Calls GET /sites.

Properties:

Published Outputs: - result — the JSON response body - status — HTTP status code

3. get_site — Get one site

One SharePoint site by id. Calls GET /sites/{siteId}.

Properties:

Published Outputs: - result — the JSON response body - status — HTTP status code

4. list_site_drives — List a site's libraries

The document libraries on a site, each with its driveId. Calls GET /sites/{siteId}/drives.

Properties:

Published Outputs: - result — the JSON response body - status — HTTP status code

5. list_root_children — List a drive's root

The top-level items in a drive. Calls GET /drives/{driveId}/root/children.

Properties:

Published Outputs: - result — the JSON response body - status — HTTP status code

6. list_item_children — List a folder's contents

The items inside a folder. Calls GET /drives/{driveId}/items/{itemId}/children.

Properties:

Published Outputs: - result — the JSON response body - status — HTTP status code

7. get_drive_item — Get one file or folder

One item's metadata, including @microsoft.graph.downloadUrl. Calls GET /drives/{driveId}/items/{itemId}.

Properties:

Published Outputs: - result — the JSON response body - status — HTTP status code

Paging

Graph answers a collection with 100 rows and an @odata.nextLink, so a naive listing returns a fraction of a large tenant with HTTP 200 and no sign anything is missing. This connector follows the continuation link until the collection is exhausted. If it stops at the page cap it says so — the result carries complete: false with a warning, and the step returns WARNING rather than SUCCESS. A page cap must never look like the end of the data.

Notes

This connector returns metadata, not bytes — deliberately. Graph answers /content with a redirect to a storage host and then a raw stream. A spreadsheet is not JSON, and a connector whose contract is "return the JSON response body" would hand back a mangled string or exhaust memory on a large file. Fetching a file is two steps:

1. get_drive_item → take @microsoft.graph.downloadUrl off the response.
2. Fetch that URL with the http or file tool.

That URL is pre-authenticated — it carries its own token, so the fetch must not add an Authorization header — and it expires in about an hour, so fetch it now rather than storing it in a job definition.

A drive is not a site. OneDrive gives each user a drive (get_user_drive); a SharePoint site has one drive per document library (list_site_drives). "The team's files" is almost always a site drive, and looking under someone's personal drive finds nothing while returning 200.

list_sites needs a search term. Pass {"search": "*"} to enumerate, or a fragment of the name to narrow.

Self-Contained JAR

The jar bundles all runtime dependencies; only intouch-tool-api is provided by the server.

Publishes

The keys a later task may reference as {{taskName.key}}. Referencing anything not listed here resolves to nothing at run time.

• complete
• operation
• result
• status
• warning