What permissions are required for /_api/SPSiteManager/create

[Litwilly]

What permissions are required for /_api/SPSiteManager/create

---

Document Details

⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

• ID: 26b24cbb-892e-8e39-8a24-ad5997cae065
• Version Independent ID: b643463a-91b8-3230-e314-6522f35e5bd9
• Content: Create Modern SharePoint Sites using REST
• Content Source: docs/apis/site-creation-rest.md
• Product: sharepoint
• GitHub Login: @VesaJuvonen
• Microsoft Alias: vesaj

Thank you for reporting this issue. We will be triaging your incoming issue as soon as possible.

[michaelhan-1]

Per my knowledge, creating modern sites doesn't need any permissions.

As a internal user, you could create modern sites using /_api/SPSiteManager/create

Michael Han
Microsoft SharePoint Community Support

[Litwilly]

This is the response I am getting using /_api/SPSiteManager/create with an OAuth 2.0 application token that has permissions to create sharepoint subsites via the Microsoft Graph API

[Litwilly]

Update: I was using the following scope "https://graph.microsoft.com/.default" I updated this to "https://yourSite.sharepoint.com/.default" and am now getting:

[Litwilly]

This led me to an article about needing a cert for the app: azure - https://stackoverflow.com/questions/56526581/sharepoint-online-unsupported-app-only-token

After following the documentation to do that, still getting the same unsupported app only token.

[michaelhan-1]

You need to get the access token like this:

 Grant Type :         Authorization Code 
 Callback Url :       this should be the AAD App redirect Url 
 Auth URL :           https://login.microsoftonline.com/common/oauth2/authorize?resource=https%3A%2F%2F<tenant_name>.sharepoint.com  
 Access Token URL :   https://login.microsoftonline.com/common/oauth2/token  
 Client ID :          <client_ID>  
 Client Secret :      <Client-secret>  

[Litwilly]

So looks like your setting up the call for delegated access (user - grant type - auth code).

I'm trying to create a site with application-level access (app only - grant type - client cred).

I believe it is possible. It requires a client and cert, the issue is creating the client assertation which looks simple for C#, .Net, or PS, but I'm not really sure the feasibility through a 3rd party ie Postman (and my end goal of ServiceNow).

Regardless I was able to get it working via delegated access, however, it did require that I have Delegated SharePoint: AllSites.FullControl API permissions.

Some of the resources that have helped me gather this conclusion:
https://blog.mastykarz.nl/azure-ad-app-only-access-token-using-certificate-dotnet-core/
https://docs.microsoft.com/en-us/archive/blogs/richard_dizeregas_blog/performing-app-only-operations-on-sharepoint-online-through-azure-ad
https://github.com/AzureAD/microsoft-authentication-library-for-dotnet/wiki/Client-Assertions
https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-client-creds-grant-flow#second-case-access-token-request-with-a-certificate
https://stackoverflow.com/questions/63244752/using-a-certificate-in-azure-active-directory-to-sign-and-return-an-access-token
https://stackoverflow.com/questions/56526581/sharepoint-online-unsupported-app-only-token

[Litwilly]

@michaelhan-1 delegated access via a service account is providing its own challenges because I'm struggling to figure out how to get a refresh token, I'm able to get an access token but it has a 1 hr expiration. Appreciate any help here!

[github-actions]

Thank you for taking the time to file an issue. We periodically archive older or inactive issues as part of our issue management process, which automatically closes them once they are archived.

If you’d like to understand more about why and how we handle archived (closed) issues, please see Our approach to closed issues.

We appreciate your contribution and if this is still an active issue with the latest SPFx versions, please do resubmit the details. We needed to perform a cleanup, so that we can start with a clean table with a new process. We apologize for the inconvenience this might cause.