can't use contentStream API

The 401 error you are encountering, along with the message about an "Invalid audience Uri," typically indicates that the token you are using does not have the necessary permissions for the API you are trying to access. Here are a few steps you can take to troubleshoot this issue:

1. Check Token Scope: Ensure that the token you are using has the correct scopes for accessing the content stream API. The scopes required for different APIs can vary, and you may need to request additional permissions when obtaining the token.
2. Audience URI: The audience URI in the token must match the API you are trying to access. Make sure that the token is issued for the correct audience that corresponds to the Microsoft Graph API.
3. Token Validity: Verify that the token is still valid and has not expired. If necessary, refresh the token and try again.
4. API Endpoint: Double-check that you are using the correct endpoint for the content stream API. Ensure that there are no typos in the URL.
5. Permissions: If you are accessing a shared drive or a specific user's drive, ensure that the user or service principal has the necessary permissions to access the item you are trying to download.

If you continue to experience issues, consider reviewing the API documentation for any specific requirements related to authentication and permissions.

References:

• Get-MgBetaUserDriveItemContentStream

those suggestions are not hepful. Token is valid, since it works for /content endpoint.

What i noticed instead is that /contentStream is working on communication sites, and failing with 401 on personal onedrives

Note that i'm using an application to invoke the APIs, with Files.Read.All application type permission granted.

Hi @StefanoPadovan,

Welcome to Microsoft Q&A, and thank you very much for reaching out to us.

Based on your description, you able to use the Graph API content endpoint to retrieve a personal OneDrive file with the same token, but when calling the contentStream endpoint for personal drives, you get a 401 error with an HTML response saying Invalid audience Uri. Please let me know if I misunderstood.

Please note that the /beta endpoints in Microsoft Graph are preview features and are subject to change. They may not be fully supported for production use, and their behavior or availability can change without notice.

For my research, this issue might relate to how the contentStream endpoint validates the token’s audience against the actual storage backend:

• For SharePoint communication or team sites (hosted under https://{tenant}.sharepoint.com), a token scoped to that host using the SharePoint resource principal 00000003-0000-0ff1-ce00-000000000000 and https://{tenant}.sharepoint.com/.default typically works, and streaming succeeds.
• However, For Personal OneDrive for Business (“My Files”), the storage backend is hosted under https://{tenant}-my.sharepoint.com. When contentStream redirects to this host, continuing with a Microsoft Graph token or a SharePoint token scoped only to sharepoint.com (instead of -my.sharepoint.com) may result in a 401 Invalid audience Uri, because the audience doesn’t match the -my host.

This difference between sharepoint.com and -my.sharepoint.com might explains why one token works for site libraries but fails for personal OneDrive.

This summary is based on my findings from the community and several relevant threads. However, it may not accurately reflect the behavior in question. As Microsoft moderator, I do not have access to your configuration, and my testing environment is limited, so I can only assist you through research and available resources. To help you reach your goal more effectively, I recommend posting a thread on the Microsoft Tech Community forum. It’s a great platform for deeper technical discussions and connecting with individuals who have hands-on experience and expertise. They’re best positioned to provide guidance and valuable insights on this topic.   

I hope this help.

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread. 

the Prefer trick is not making any difference.

Using a sharepoint-scoped token does not allow me to use the contentStream API, since that is Graph based