Forum Discussion
Create Sharepoint shortcut in Fabric lakehouse by code/API
Hi amaaiia,
The API you are trying to use is the correct one, https://learn.microsoft.com/en-us/rest/api/fabric/core/onelake-shortcuts/create-shortcut?tabs=HTTP
Note that your body has incorrect parameters, specifically there is no "displayName" property.
Here is the sharepoint example from the documentation:
{
"path": "Files",
"name": "MyOneDriveSharePoint",
"target": {
"oneDriveSharePoint": {
"location": "https://microsoft.sharepoint.com",
"subpath": "/Shared Documents/Test Folder",
"connectionId": "97e33458-1353-4911-96b1-6f4f4bbfd335",
"updateFabricItemSensitivity": false
}
}
}
The 403 error means whatever user is being used does not have permissions to do what you are trying to do. Can you confirm if you are using your account or a service principal to run the notebook? Can you confirm what workspace permissions you have on the workspace where the lakehouse you are trying to add a shortcut to is?
I realized I was entering the payload incorrectly. I updated it, but I'm still getting the same error ("The caller does not have sufficient scopes to perform this operation). My personal account is an Admin on the workspace, and I do have access to the SharePoint site. The connectionId I'm using works because I'm using it to cerate shortcuts manually in the lakehouse.
I tried something else, which was using a service principal instead of my own account. I granted the app the necessary API permissions, and I think I’ve resolved that issue.
credential = ClientSecretCredential(
tenant_id=tenant_id,
client_id=client_id,
client_secret=client_secret
)
def get_token():
return credential.get_token(
"https://api.fabric.microsoft.com/.default"
).token
client = FabricRestClient(token_provider=get_token)
Now, when I list the connections, I can see them. But now I’m getting another error when trying to create a new shortcut using that connection:
payload = {
"name": shortcut_name,
"path": "Files",
"target": {
"oneDriveSharePoint": {
"connectionId": connectionId,
"location": location,
"subpath": subpath
}
}
}
response = client.post(
f"/v1/workspaces/{new_ws_id}/items/{lakehouse_id}/shortcuts",
json=payload
)
if response.status_code not in [200, 201]:
print(response.text)
raise Exception(response.text)
print("✅ Shortcut created")FabricHTTPException
400 Bad Request for url: https://api.fabric.microsoft.com//v1/workspaces/xxxxxxxxxxxxxx/items/xxxxxxxxxxxxxxxxx/shortcuts Error: {"requestId":"xxxxxxxxxxxx","errorCode":"BadRequest","moreDetails":[{"errorCode":"SharePointResourceNotFound","message":"Error getting DriveId from SharePoint API: Forbidden. StatusCode: Forbidden. Details: {\"StatusCode\":403,\"ReasonPhrase\":\"Forbidden\",\"RequestUri\":\"https://xxxxx.sharepoint.com/sites/YYYYYYYYYYY/_api/v2.0/shares/u!xxxxxxxxxxxxxxxxxx/drive?$select=id,name,driveType,folder\",\"Details\":\"{\\\"error\\\":{\\\"code\\\":\\\"accessDenied\\\",\\\"innerError\\\":{\\\"code\\\":\\\"sharesAccessDenied\\\"},\\\"message\\\":\\\"The system cannot find the file specified. (Exception from HRESULT: 0x80070002)\\\",\\\"@onedrive.linkFeatures\\\":[]}}\"}"}],"message":"The request could not be processed due to missing or invalid information","isRetriable":false} Headers: {'Cache-Control': 'no-store, must-revalidate, no-cache', 'Pragma': 'no-cache', 'Transfer-Encoding': 'chunked', 'Content-Type': 'application/json; charset=utf-8', 'x-ms-public-api-error-code': 'BadRequest', 'Strict-Transport-Security': 'max-age=31536000; includeSubDomains', 'X-Frame-Options': 'deny', 'X-Content-Type-Options': 'nosniff', 'RequestId': 'xxxxxxxxxxxx', 'Access-Control-Expose-Headers': 'RequestId', 'request-redirected': 'true', 'home-cluster-uri': 'https://wabi-north-europe-i-primary-redirect.analysis.windows.net/', 'Date': 'Tue, 02 Jun 2026 14:46:17 GMT'}
- My connection is using Service Principal authentication (specifically, I have an app that has access to the SharePoint site, and that’s the one I use for authentication in the connection). Connection is working because I use it to create shortcuts manually.
- I have another master app that I use to create the Fabric token.
Copilot tells me that this issue is because the app I'm using to get fabric token doesn't have access to sharepoint. But it this true?
When I create manual shortcuts using this connection, it uses the token from my personal account, which shouldn't have access to SharePoint, since it's the connection itself—which uses Service Principal authentication—that authenticates against SharePoint.
I understand that even if I use another app to obtain the token, the behavior should be the same—that is, the Fabric token app does not have access to SharePoint (just like my personal account)—but when using the SharePoint connection with the app that DOES have access to SharePoint, it is that app that is used for authentication with the SharePoint site.
I've designed a mockup to better understand de use case of what is happening: