Microsoft Graph OneDrive Personal — HTTP 400 invalidRequest when listing children of a shared remoteItem folder

armindo de sousa 0 Reputation points
2026-10-20T07:48:17.0033333+00:00

Title: Microsoft Graph OneDrive Personal — HTTP 400 invalidRequest when listing children of a shared remoteItem folder

Hello Microsoft Graph Support Team,

I am developing a personal AI assistant named ADRI that integrates with OneDrive Personal through Microsoft Graph v1.0, using delegated OAuth authentication with a personal Microsoft account.

I am experiencing a reproducible HTTP 400 invalidRequest when attempting to enumerate the children of a shared remote folder.

Technical details

  • Account type: Personal Microsoft account (consumer OneDrive).

API: Microsoft Graph v1.0.

Delegated permission: Files.ReadWrite.

Resource type: Shared folder represented by remoteItem.

driveId: Obtained from remoteItem.parentReference.driveId.

itemId: Obtained from remoteItem.id.

Endpoint: GET /v1.0/drives/{drive-id}/items/{item-id}/children.

HTTP status: 400 Bad Request.

Graph error code: invalidRequest.

Date: October 19, 2026.

Time: Approximately 20:17:58 UTC.

Microsoft Graph request IDs

With the $top=30 parameter: 7a3c2f09-79fc-4e35-93b5-7d49572a26d5

Without $top: e68c10f1-5c10-4b20-b663-c986b61ce64e

Both requests failed on the same shared folder.

The application successfully enumerates other OneDrive items and has retrieved 76 distinct file references. The issue appears isolated to this specific shared remote folder.

Could you please help clarify:

Can the Microsoft Graph team investigate these request IDs and their server-side error details?

Does invalidRequest indicate that the remote driveId/itemId pair may be invalid, stale, or incompatible with this operation?

Are there special requirements or a different supported endpoint for enumerating shared folders in OneDrive Personal?

Could sharing permissions or ownership restrictions produce this behavior even with delegated Files.ReadWrite?

What is the officially supported, secure method for accessing this folder's children?

We have confirmed that removing $top does not resolve the error. The failure also occurs on the first page, rather than on an @odata.nextLink continuation.

We have not independently confirmed that the remote driveId/itemId pair still identifies an accessible resource.

I would appreciate guidance based on the request IDs, or escalation to the appropriate Graph/OneDrive engineering team if possible.

For privacy reasons, I have not included OAuth tokens, account identifiers, actual drive/item IDs, or private file information in this public report. I can provide additional sanitized diagnostics through an approved private support channel if necessary.

Thank you for your assistance.Title: Microsoft Graph OneDrive Personal — HTTP 400 invalidRequest when listing children of a shared remoteItem folder

Hello Microsoft Graph Support Team,

I am developing a personal AI assistant named ADRI that integrates with OneDrive Personal through Microsoft Graph v1.0, using delegated OAuth authentication with a personal Microsoft account.

I am experiencing a reproducible HTTP 400 invalidRequest when attempting to enumerate the children of a shared remote folder.

Technical details

Account type: Personal Microsoft account (consumer OneDrive).

API: Microsoft Graph v1.0.

Delegated permission: Files.ReadWrite.

Resource type: Shared folder represented by remoteItem.

driveId: Obtained from remoteItem.parentReference.driveId.

itemId: Obtained from remoteItem.id.

Endpoint: GET /v1.0/drives/{drive-id}/items/{item-id}/children.

HTTP status: 400 Bad Request.

Graph error code: invalidRequest.

Date: October 19, 2026.

Time: Approximately 20:17:58 UTC.

Microsoft Graph request IDs

With the $top=30 parameter: 7a3c2f09-79fc-4e35-93b5-7d49572a26d5

Without $top: e68c10f1-5c10-4b20-b663-c986b61ce64e

Both requests failed on the same shared folder.

The application successfully enumerates other OneDrive items and has retrieved 76 distinct file references. The issue appears isolated to this specific shared remote folder.

Could you please help clarify:

Can the Microsoft Graph team investigate these request IDs and their server-side error details?

Does invalidRequest indicate that the remote driveId/itemId pair may be invalid, stale, or incompatible with this operation?

Are there special requirements or a different supported endpoint for enumerating shared folders in OneDrive Personal?

Could sharing permissions or ownership restrictions produce this behavior even with delegated Files.ReadWrite?

What is the officially supported, secure method for accessing this folder's children?

We have confirmed that removing $top does not resolve the error. The failure also occurs on the first page, rather than on an @odata.nextLink continuation.

We have not independently confirmed that the remote driveId/itemId pair still identifies an accessible resource.

I would appreciate guidance based on the request IDs, or escalation to the appropriate Graph/OneDrive engineering team if possible.

For privacy reasons, I have not included OAuth tokens, account identifiers, actual drive/item IDs, or private file information in this public report. I can provide additional sanitized diagnostics through an approved private support channel if necessary.

Thank you for your assistance.

Microsoft Security | Microsoft Graph
0 comments No comments

1 answer

Sort by: Most helpful
  1. armindo de sousa 0 Reputation points
    2026-10-20T07:54:16.8733333+00:00

    Thank you for your response.

    Our application already implements the documented approach using remoteItem.parentReference.driveId and remoteItem.id, rather than the local shortcut ID.

    However, Microsoft Graph consistently returns HTTP 400 invalidRequest on the first request to /drives/{drive-id}/items/{item-id}/children, both with and without $top.

    The relevant request IDs are:

    7a3c2f09-79fc-4e35-93b5-7d49572a26d5

    e68c10f1-5c10-4b20-b663-c986b61ce64e

    Both requests occurred on October 19, 2026, at approximately 20:17:58 UTC.

    Could a Microsoft Graph engineer review these request IDs or advise how to distinguish an invalid remote item identity from a sharing/access restriction?

    We would appreciate a technical diagnosis rather than a repetition of the documented API pattern.

    Thank you.

    Was this answer helpful?

    0 comments No comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.