SharePoint API for Small Business: What to Ask a Developer

The SharePoint API is how software reads and writes your SharePoint sites without a person clicking. Microsoft offers two: the older SharePoint REST API and Microsoft Graph, which Microsoft now recommends. Any integration needs an app registration in Microsoft Entra ID, a choice between delegated and application permissions, and a plan for throttling.

This guide is written for the owner or manager who is about to pay someone to connect a line-of-business system, a website or an automation to SharePoint. You do not need to write code; you need to know which questions separate a safe integration from one that can read every file in the company. For the structure the integration will sit on, see how to set up SharePoint for a small business. If the work is really AI over your documents, read SharePoint agents first; Microsoft may already have built it.

What is the SharePoint API?

An API (application programming interface) is a documented set of web addresses a program can call to get or change data. SharePoint has had one for years: the REST service, reached under /_api/ on any site, where for example /_api/web returns the site and /_api/lists/getbytitle('Contracts')/items returns a list's items. It supports create, read, update and delete through standard HTTP verbs and can batch several requests into one call (Get to know the SharePoint REST service, Microsoft Learn, checked on November 7, 2026).

Microsoft Graph is the newer, single API across Microsoft 365, and it covers SharePoint too: sites, lists and drives (document libraries) under https://graph.microsoft.com/v1.0/sites/.... Microsoft describes read-only support for sites (an app cannot create sites through it) and read-write support for lists, list items and drive items, addressed by ID, URL or path (Working with SharePoint sites in Microsoft Graph, Microsoft Learn, checked on November 7, 2026).

SharePoint REST API vs Microsoft Graph: which should a developer use?

	SharePoint REST API	Microsoft Graph
Scope	SharePoint only, very deep (site settings, permissions, search, features)	All of Microsoft 365: SharePoint, OneDrive, Teams, Outlook, users and groups
Microsoft's guidance	Still supported; "This retirement does not retire SharePoint REST APIs, CSOM, JSOM, or SharePoint Framework"	"Choose Microsoft Graph APIs over CSOM and REST APIs when possible"
Throttling cost	No fixed resource unit cost; "usually consume more resource units than Microsoft Graph"	Predictable resource units per request (1, 2 or 5)
Authentication	Microsoft Entra ID (Azure ACS retired April 2, 2026)	Microsoft Entra ID
Fine-grained access	Sites.Selected via Entra app	Sites.Selected, Lists.SelectedOperations.Selected, Files.SelectedOperations.Selected
Pick it when	You need something Graph does not expose yet	Anything new, especially file and list integrations

The sentences in the table come from Microsoft's throttling and retirement pages, cited below. The practical answer for a small business: a new integration should use Microsoft Graph unless the developer can name the specific capability that only REST provides.

One more date matters. SharePoint Add-ins and the Azure ACS authentication they relied on reached end of life in SharePoint Online on April 2, 2026, with no extension; applications that used ACS must authenticate through Microsoft Entra ID instead (Azure ACS retirement in Microsoft 365, Microsoft Learn, checked on November 7, 2026). If a vendor's connector is older than that and still works, ask how it authenticates.

What is an app registration and why does your developer need one?

An app registration is the identity your integration uses to sign in. Without one, nothing can call either API. Microsoft's steps: sign in to the Microsoft Entra admin center with at least the Application Developer role, go to Entra ID > App registrations > New registration, give the app a meaningful name, choose who can use it (Microsoft recommends Single tenant only for most applications), select Register, then record the Application (client) ID (How to register an app in Microsoft Entra ID, Microsoft Learn, checked on November 7, 2026).

For a business owner, three things follow. The registration should live in your tenant, named for the system it serves, so you can see and remove it. Its credentials (a certificate or a client secret) expire and need an owner. And the permissions attached to it, covered next, are the whole security story.

Delegated vs application permissions: what is the difference?

Microsoft draws the line clearly. Delegated permissions "allow the application to act on a user's behalf. The application isn't able to access anything the signed in user couldn't access." Application permissions are used "without a signed-in user present. The application is able to access any data that the permission is associated with," and Microsoft's example is blunt: an app granted the application permission Files.Read.All "is able to read any file in the tenant." Only an administrator can consent to application permissions (Overview of permissions and consent in the Microsoft identity platform, Microsoft Learn, checked on November 7, 2026).

So the first question for any developer is: does this run while a person is signed in (delegated), or on its own at 2 a.m. (application)? Automations and syncs need application permissions, which is exactly why the next section matters.

What is Sites.Selected and why should you insist on it?

By default, application permissions such as Sites.Read.All or Sites.ReadWrite.All cover every site in the tenant. Sites.Selected does the opposite: the app gets nothing until an administrator grants it a role on a specific site. Microsoft explains that Selected scopes "require an explicit assignment action; an application consented for Lists.SelectedOperations.Selected would initially have no access," and that newer scopes narrow access further to a single list (Lists.SelectedOperations.Selected), to list items and folders (ListItems.SelectedOperations.Selected) or to files (Files.SelectedOperations.Selected). The roles are read, write, owner and fullcontrol. Access needs three things at once: the scope consented in Entra ID, a permission granted on the resource, and a token carrying that scope; remove any one and the app is locked out. Microsoft also notes that "Delegated is preferred when possible" (Overview of Selected permissions in OneDrive and SharePoint, Microsoft Learn, checked on November 7, 2026).

For a small business this is the difference between "the invoicing system can write to the Finance site's Invoices library" and "the invoicing system can read HR." Ask for Sites.Selected, or the list or file level variants, and ask which site and role were granted. Then put that app in your permissions worksheet next to the people.

What is throttling and how does it affect an integration?

Throttling is SharePoint slowing down or refusing an application that calls too often. Microsoft returns HTTP 429 (too many requests) or 503 (server too busy) with a Retry-After header saying how long to wait, and warns that throttled requests still count toward the limit, so "aggressive retries work against calling applications." Limits are per application per tenant and scale with licenses: for a tenant with up to 1,000 licenses, an app gets 1,200,000 resource units per 24 hours and 1,250 per minute, where a simple Graph read costs 1 unit and a write or multi-item query costs 2. Microsoft asks developers to identify their traffic with a User-Agent string in the form NONISV|CompanyName|AppName/Version, says load testing is not allowed on SharePoint Online, and notes that SharePoint Online does not return IETF RateLimit headers, so apps must honor Retry-After (Avoid getting throttled or blocked in SharePoint Online, Microsoft Learn, checked on November 7, 2026).

What this means for you: a nightly job that reads 50,000 files is fine if it uses delta queries and backs off; a dashboard that polls a library every second is not. Ask how the integration handles 429 responses and whether it was tested against a copy of your real volume.

Do you need the API at all?

Often not. Power Automate's SharePoint connector is a standard connector with triggers such as When an item is created, When an item is created or modified, When a file is created (properties only) and When a file is created or modified (properties only), and it is throttled at 600 API calls per connection per 60 seconds (SharePoint connector reference, Microsoft Learn, checked on November 7, 2026). For "when a contract is uploaded, tell accounting and copy the metadata to the tracker," that is the whole project, and our approval workflow guide shows the pattern. Reach for custom code when the volume, the other system or the logic exceeds what a flow does comfortably, or when a vendor's product already integrates and you are only reviewing its permissions.

What should you ask a developer before signing?

1. Which API will you use, and if not Microsoft Graph, which capability requires the SharePoint REST API?
2. Will the app run as a signed-in user (delegated) or on its own (application)? If application, which sites or lists will it be granted through Sites.Selected, and with which role?
3. Where will the app registration live, what will it be named, and who owns credential rotation?
4. How does the code handle 429 and 503 responses and the Retry-After header? Does it use delta queries for scans?
5. Does the traffic carry the User-Agent string Microsoft asks for?
6. Where are secrets stored, and how do we revoke access the day we stop using the system?
7. What logging will tell us what the app read and changed?
8. Is any of this already covered by Power Automate, a Graph connector or the vendor's own integration?

A developer who answers these in plain language is one you can work with. Our SharePoint consulting team reviews proposed integrations against exactly this list, and the sync guide covers the case where the "integration" people actually want is files in File Explorer.

What this does not do, and the limits to plan around

• Microsoft Graph cannot create SharePoint sites; site provisioning still uses SharePoint's own APIs or admin tools.
• Sites.Selected grants are per site collection; narrower scopes exist for lists and files, and granting them on items breaks permission inheritance on those items.
• Throttling limits are defaults Microsoft can change, and Microsoft reserves the right to lower limits on unpaid or unlicensed usage.
• Load testing against SharePoint Online is not allowed.
• Add-ins and Azure ACS authentication no longer work in SharePoint Online; legacy connectors need rebuilding, not patching.

Frequently asked questions

Is the SharePoint API free?

There is no separate charge for calling the SharePoint REST API or Microsoft Graph against your own tenant; it is part of the service your licenses pay for. Microsoft does apply throttling limits that scale with license count and reserves the right to lower limits on unpaid or unlicensed usage.

Can a vendor's app read all of our files?

It can if it was granted a tenant-wide application permission such as Sites.Read.All or Files.Read.All. Ask for Sites.Selected or a narrower Selected scope instead, so the app is limited to the sites, lists or files you grant.

Should a new project use Graph or the SharePoint REST API?

Microsoft Graph, unless the developer can name a specific capability only REST provides. Microsoft's own guidance is to choose Graph over CSOM and REST when possible, and Graph has predictable throttling costs.

What happened to SharePoint Add-ins?

They reached end of life in SharePoint Online on April 2, 2026, along with Azure ACS authentication. The REST API, CSOM and the SharePoint Framework continue; external applications authenticate through Microsoft Entra ID.

How do we revoke an integration's access?

Remove the app's permission grant on the site (for Selected scopes), revoke the scope consent in Entra ID, or delete the app registration. Any one of those blocks access; do all three when you retire a system.

What is CSOM?

The client-side object model: Microsoft's older .NET and JavaScript libraries for talking to SharePoint. It still works, but Microsoft recommends Graph for new work because CSOM and REST consume more throttling resources for the same result.

Sources

Checked on November 7, 2026.

• Get to know the SharePoint REST service, Microsoft Learn: endpoints, CRUD operations and batching.
• Working with SharePoint sites in Microsoft Graph, Microsoft Learn: sites, lists and drives, read-only sites.
• Azure ACS retirement in Microsoft 365, Microsoft Learn: the April 2, 2026 retirement of Add-ins and ACS.
• How to register an app in Microsoft Entra ID, Microsoft Learn.
• Overview of permissions and consent in the Microsoft identity platform, Microsoft Learn: delegated vs application permissions and who consents.
• Overview of Selected permissions in OneDrive and SharePoint, Microsoft Learn: Sites.Selected, the narrower Selected scopes and roles.
• Avoid getting throttled or blocked in SharePoint Online, Microsoft Learn: 429 and 503, Retry-After, resource units, per-app limits and traffic decoration.
• SharePoint connector, Microsoft Learn: Power Automate triggers and the 600 calls per 60 seconds limit.