Security Policy Errors

How to Resolve SharePoint REST API Audience URI Validation Errors

Nimra Malik Oct 10, 2026 868 views

Question details

Users need to resolve an AudienceUriValidationException that occurs when making SharePoint REST API requests, typically caused by incorrect token audience routing or lacking app-only permissions.

How to Resolve SharePoint REST API Audience URI Validation Errors

Product: SharePoint
Device & OS: not provided
Scenario: Making API requests to a SharePoint site collection using an access token for app-only authentication.
Observed behavior: The REST API request fails and returns an AudienceUriValidationException, indicating that the access token was issued for the wrong resource or lacks proper authorization.

Before you start

Ensure you have Site Collection Administrator privileges for the target SharePoint site and that you are using the correct tenant URL.

Solution 1Recommended

Configure Legacy SharePoint App-Only Permissions

Register the application directly within SharePoint and apply an XML permission policy to ensure the token audience matches the site.

Azure app registration and legacy SharePoint app-only authorization are handled differently. If your REST API requests via Postman or other clients fail with an audience URI error, you must register the app directly in SharePoint and assign the necessary Site Collection rights.

Register the App using appregnew.aspx

Navigate to your SharePoint site and append '/_layouts/15/appregnew.aspx' to the URL. Click 'Generate' for both the Client ID and Client Secret, fill in the App Domain and Redirect URI, and click 'Create'.

Look up the App in appinv.aspx

Go to '/_layouts/15/appinv.aspx' on your SharePoint site. Paste the Client ID you just generated into the App Id field and click 'Lookup' to populate the application details.

Apply the AppPermissionRequests XML

In the Permission Request XML text box, paste the following policy: <AppPermissionRequests AllowAppOnlyPolicy="true"><AppPermissionRequest Scope="http://sharepoint/content/sitecollection" Right="FullControl" /></AppPermissionRequests> and click 'Create'.

Trust the Application

You will be prompted to trust the add-in. Click 'Trust It' to finalize the app-only permission setup. Use this Client ID and Secret to request a new token, ensuring the audience matches the SharePoint resource.

Configure Legacy SharePoint App-Only Permissions

Token Audience Verification: By registering the app directly in SharePoint, the access token generated will correctly identify the SharePoint site as the target audience, resolving the AudienceUriValidationException.

Free Microsoft Office alternative

Looking for a Simpler Way to Manage Documents?

While resolving complex SharePoint REST API and token configurations, you may need a reliable and lightweight tool for everyday document management. WPS Office offers a free, high-performance alternative to Microsoft Office for seamless document creation and collaboration.

1. Download the Installer: Visit the official WPS Office website and download the free installation package for your operating system.
2. Install WPS Office: Run the downloaded installer and follow the on-screen instructions to set up the software.
3. Open Your Office Documents: Launch WPS Office to easily open, edit, and save your existing .docx, .xlsx, and .pptx files.

Fully compatible with Microsoft Word, Excel, and PowerPoint formats.Lightweight application with exceptionally fast startup times.Built-in robust PDF editing and conversion tools.Familiar, easy-to-use interface with a completely free tier.

microsoft office alternative - wps office

Frequently Asked Questions

Why do I get an AudienceUriValidationException in Postman?

This error occurs when the access token used in Postman was issued for a different resource (such as Microsoft Graph) rather than the specific SharePoint site, or if the required SharePoint app-only permissions are missing.

Can I use Azure App Registration instead of appregnew.aspx?

While Azure App Registration is used for modern Microsoft Graph API access, legacy SharePoint app-only authorization handles tokens differently. If you are targeting SharePoint-specific APIs and encountering URI errors, registering via appregnew.aspx is often required.

What XML scope is needed for site collection full control?

To grant full control at the site collection level, use the scope 'http://sharepoint/content/sitecollection' and set the Right attribute to 'FullControl' within your AppPermissionRequest XML policy.

Microsoft Office Security Issues