Microsoft Graph

Twin of Microsoft Graph v1.0.


Covers	`graph.microsoft.com`
Auth	Microsoft Entra bearer tokens
Webhooks	Yes
Operations	102

Coverage

Outlook mail (messages, folders, attachments, send, copy and move), Outlook calendar (calendars, events, calendar view, instances, attachments), Teams (teams, channels, chats, members and messages), change-notification subscriptions, and user and group delta. Files are not part of this twin, so there are no OneDrive or SharePoint operations. Only the v1.0 surface is served: a path under /beta is a 404 naming the version.

Credentials

This twin issues no tokens of its own. It verifies the ones Microsoft Identity mints, so any well-formed Entra access token from there authenticates by default and your existing credentials need no change. The auth.mode switch that restricts it to credentials the world knows lives on Microsoft Identity rather than here. See Credentials.

Each product’s permissions are granted separately, and the two spellings of a permission (bare and resource-qualified) collapse to the same name. Teams needs a work or school account; a consumer account is refused.

Vendor specific details

The credential is checked before routing. An unknown path with no token gets the same 401 InvalidAuthenticationToken as a real one, so a URL typo looks like an auth failure until you fix the token.
The OData router folds literal-segment case and a terminal slash together, so /V1.0/ME/MAILFOLDERS/ answers byte for byte like /v1.0/me/mailFolders.
A DELETE on a delta URL is treated as the read. /v1.0/me/mailFolders/delta answers 200 with a @odata.deltaLink and deletes nothing.
Creating a subscription calls your notificationUrl first and only succeeds if it echoes the validationToken back as text/plain. A receiver that is not listening yet fails the create rather than the first notification.
HEAD and OPTIONS are 405 with a completely empty body and no Content-Type, so there is nothing for an error parser to read.

Its own notes

Once a sandbox is running, this twin serves its own operating notes at {control_url}/veris/manual: the credentials it accepts, the API versions it serves, and the fault statuses you can arm against it. They are generated from the same source as its behaviour, so they cannot drift.