Office Outlook Add-In OAuth Error

Question

i'm currently developing an Office Outlook App. I'm trying to get the messages (specially the Attachments of messages) from the Exchange Server. I'm using the Outlook Desktop Application.

I already got the bearer authentication token and i'm trying using the Office REST-API to get the messages, but there is a strange error if i send the GET request to the server.

Error: "The api you are trying to access does not support item scoped OAuth."

Here is my JavaScript-Code:

        Office.context.mailbox.getCallbackTokenAsync(function (asyncResult) {
        if (asyncResult.status === "succeeded") {
            var authToken = asyncResult.value;
            var attUrl = 'https://outlook.office.com/api/v2.0/me/mailfolders/inbox/messages/';
            $.ajax({
                method: "GET",
                url: attUrl,
                beforeSend: function (request) {
                    request.setRequestHeader("Accept", "text/*, application/xml, application/json; odata.metadata=none");
                    request.setRequestHeader("Authorization", "Bearer " + authToken);
                    request.setRequestHeader("X-AnchorMailbox", "[e-mail]");
                },
                success: function (responseData) {
                    console.log("success", responseData);
                },
                error: function (errData) {
                    console.log("err", errData);
                }
            });
        }
    });

I'm scanning the outgoing traffic and there seems everything ok:

GET outlook.office.com/api/v2.0/me/mailfolders/inbox/messages/ HTTP/1.1

Authorization: Bearer TokenIsCorrect

Accept: text/*, application/xml, application/json; odata.metadata=none

X-AnchorMailbox: [e-mail]

Referer: localhost:44300/AddInRead/App/Index/Index.html

Accept-Language: de-DE

Origin: localhost:44300

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko

Host: outlook.office.com

DNT: 1

Connection: Keep-Alive

Cache-Control: no-cache

.................

I refered to: Outlook Mail REST-API Reference

and the samples on Outlook Dev Center OAuth Sandbox

I think i searched the hole internet, but couldn't find anything to fix this problem.

Hopefully someone can give me the right hint.

BTW: had to remove some links cause of no reputation of my account :/

Thanks !

Answer 1

I found the problem and i was able to fix it.

There is a difference between the Access-Token and the Token you get, if you call the Office.context.mailbox.getCallbackTokenAsync function of the REST-API. I could see that with logging-in in Outlook Dev Center OAuth Sandbox with my own account, get the token and compare this token with the token i get in VS with getCallbackTokenAsync.

They are different. The Token from the function is only for getting attachments or items. In this case i thought "items" are messages and i could start a request for all messages with that token, but wrong. You have to take the token from the function and address the attachment directly with https://outlook.office.com/api/v2.0/me/mailfolders/inbox/messages/' + idMail + '/attachments/' + mail.attachments[i].id;

Best regards