SharePoint and OneDrive package v1.0.0

Store only the complete Authorization header value, 'Bearer <token>', where <token> is a Microsoft Graph OAuth 2.0 access token minted by an external token process for the deployment's app registration. It must never be a refresh token, ID token, client secret, certificate/private key, authorization code or token-response JSON. The external process owns obtaining consent and resource grants, minting, expiry monitoring and atomic replacement in the customer's vault; this schema 1 pack performs no OAuth exchange or refresh.

For delegated user access use the authorization-code flow, with offline_access if refresh is required; refresh tokens remain with that process. For application access use client credentials at POST https://login.microsoftonline.com/TENANT_ID/oauth2/v2.0/token with scope https://graph.microsoft.com/.default; that flow issues no refresh token, so obtain a new access token. TENANT_ID is an external token-process substitution, not a registered endpoint. Default access-token lifetime is variable (normally 60 to 90 minutes); use the actual expiry from issuance, not a fixed assumed hour.

Revoke delegated consent/sessions or application consent and resource grants through the tenant's administration process. Rotating/removing an application credential blocks future minting with that credential; do not assume it invalidates an already minted access token. Remove Selected resource grants to withdraw that access. Treat revocation propagation and residual token validity as an open deployment review, not an instantaneous cut-off guarantee.

Resolve the stored header only at execution. The custody source must never include material in errors. Verify executor-only access, redaction, traces, memory and crash-dump handling in the deployment; this pack cannot establish those properties. An expired reference or refused credential prevents execution; the provider validates the access token itself.

SITE_ID, USER_ID, DRIVE_ID, ITEM_ID and SEARCH_TEXT in paths are placeholders. Before enabling, substitute the concrete site, user, drive and item each registration may access; encode search text as an OData string literal and URL path component. Never enable the literal placeholders. The host stays graph.microsoft.com. The drive/item routes serve both SharePoint document libraries and OneDrive; site drives lists libraries, while user drives discovers a user's drives. No /me route is registered, so application and delegated bindings use explicit ids.

The API tables name Files.Read as the least delegated permission and Files.Read.All as the least application permission for every registered read. Writes need Files.ReadWrite delegated or Files.ReadWrite.All application. Sites.Read.All and Sites.ReadWrite.All are documented alternatives, not narrower defaults. Delegated access acts as one signed-in user within that user's access; application access has no user and can span the tenant. Consent only the permissions for enabled capabilities.

Review Selected scopes before granting tenant-wide access: Sites.Selected, Lists.SelectedOperations.Selected and Files.SelectedOperations.Selected require consent, an explicit resource grant to the application with a suitable role, and a token containing the scope. Grant sites through the site's permissions collection, lists through the list's permissions collection, and files through the driveItem permissions collection. These setup operations are not agent capabilities in this pack. Item/list grants break inheritance. The search method explicitly does not support the Sites.Selected application permission; remove search for that deployment and verify every other selected-scope operation against its tenant before enabling it. The method-table minimums above do not establish universal Selected-scope compatibility.

Only existing-file simple upload is registered (update at R2); send the raw file stream with the documented Content-Type: text/plain. Microsoft limits this single-call upload to 250 MB. Replacing a sensitivity-labelled file with application-only authentication is unsupported. Children listing defaults to 200 entries per page; this is a default, not a declared maximum. Permission reads expose only the permissions visible to the caller and are not a full access audit. Version retention depends on tenant settings.

createLink declares update and share at R3: retainInheritedPermissions=false can remove existing permissions on the first share; the body is not restricted to a particular link type or scope. Anonymous links may expose content outside the organization. Delete moves an item to the recycle bin, not permanent purge; delete still carries the designated irreversible action at R3. Sharing cannot undo disclosure. On supported execution paths mediated by AAES Govern, irreversible actions require approval by an authorized person; this does not prevent calls through bypass or observation-only paths.

GET file content is excluded. Graph documents /content returning 302 to a short-lived preauthenticated download URL, potentially on a different host. The executor does not follow redirects or confirm 3xx responses, and the metadata downloadUrl is not a same-host content alternative. Do not fetch or expose such URLs as an implicit second capability. Metadata may contain sensitive links and must be handled as pii.

Excluded: new-file uploads, upload sessions, content downloads and conversion, copying, moving, general metadata writes, folder creation, invites, application permission provisioning, permission update/delete, version content/restore/delete, recycle-bin restore/permanent purge, delta, subscriptions, batching, beta APIs, SharePoint Embedded and sovereign-cloud hosts. Drive metadata, root and special-folder shortcuts, analytics/activities, followed/recent/shared-with-me views, follow/unfollow, thumbnails, previews, checkin/checkout/discard, sensitivity/retention labels, record locks, sharing-link grant revocation and WebSocket channels are also excluded. Only the listed Graph v1.0 operations are registered.

Schema 1 has no per-capability size/type limits or result-mode fields. By default the executor digests and discards the response body under MaxResponseBytes. Returning bytes to an agent requires a deployment registration with result mode inline_bounded: ResultMaxBytes caps decoded bytes (default 256 KiB) and ResultContentTypes allowlists media types. For pii data this registration also requires the accountable owner and reason in result_ack_owner and result_ack_reason; no acknowledgement is supplied by this draft. Oversized or disallowed inline results are refused, not truncated. Neither vendor limits nor these notes enforce an upload payload cap. The deployment must bound uploads and select data handling appropriate to its contents; pii is a starting classification, and sensitive estates must raise it. Caller query parameters do not change the dialed URL: reviewed query values and pagination tokens must be bound into the registered endpoint through deployment change control. Collection responses can be incomplete; this pack supplies no automatic pagination or completeness check.

Open custody review, pending owner: delegated versus application flow; token audience, permissions and resource grants; renewal ownership; revocation delay; executor access, custody-source errors, logs, memory and crash handling; bypass paths; and live tenant verification. Documentation review and synthetic fixtures do not close that review.