Microsoft Exchange Mailbox Folder Permissions API

openapi: 3.1.0
info:
  title: Microsoft Exchange Exchange Online Admin Accepted Domains Mailbox Folder Permissions API
  description: REST-based administrative API that enables a focused set of Exchange cmdlets and parameters as POST-only endpoints. Provides access to key tasks previously available through Exchange Web Services (EWS), including organization configuration, accepted domains, mailbox properties, mailbox folder permissions, and distribution group membership. Built as a complementary REST-first surface for specific administrative tasks caused by the EWS deprecation planned for October 2026.
  version: 2.0.0
  contact:
    name: Microsoft Support
    url: https://support.microsoft.com
    email: support@microsoft.com
  license:
    name: Microsoft API License
    url: https://www.microsoft.com/en-us/legal/terms-of-use
  x-date-modified: '2026-03-04'
servers:
- url: https://outlook.office365.com/adminapi/v2.0
  description: Exchange Online Admin API v2.0 endpoint
security:
- oauth2: []
tags:
- name: Mailbox Folder Permissions
  description: View and manage mailbox folder permissions
paths:
  /MailboxFolderPermission:
    post:
      operationId: manageMailboxFolderPermission
      summary: Microsoft Exchange Manage mailbox folder permissions
      description: View and manage permissions on mailbox folders. Supports Get, Add, Set, and Remove operations for mailbox folder permissions. Replaces the GetFolder, UpdateFolder, and CreateFolder EWS operations for permission management.
      tags:
      - Mailbox Folder Permissions
      parameters:
      - $ref: '#/components/parameters/AnchorMailboxHeader'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                CmdletInput:
                  type: object
                  properties:
                    CmdletName:
                      type: string
                      description: The permission cmdlet to execute (Get-MailboxFolderPermission, Add-MailboxFolderPermission, Set-MailboxFolderPermission, or Remove-MailboxFolderPermission)
                      example: Get-MailboxFolderPermission
                    Parameters:
                      type: object
                      description: Parameters for the cmdlet. For Get, specify Identity. For Add, specify Identity, User, and AccessRights. For Set, specify Identity, User, and AccessRights. For Remove, specify Identity and User.
                      additionalProperties: true
      responses:
        '200':
          description: Successfully executed folder permission operation
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AdminApiResponse'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
components:
  responses:
    Forbidden:
      description: Forbidden - insufficient Exchange RBAC permissions
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ODataError'
    NotFound:
      description: Not found - the specified resource was not found
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ODataError'
    Unauthorized:
      description: Unauthorized - authentication token is missing or invalid
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ODataError'
  schemas:
    ODataError:
      type: object
      description: OData error response
      properties:
        error:
          type: object
          properties:
            code:
              type: string
              description: The error code
            message:
              type: string
              description: The error message
    AdminApiResponse:
      type: object
      description: Response from the Exchange Online Admin API
      properties:
        '@odata.context':
          type: string
          description: OData context URL
        value:
          type: array
          items:
            type: object
            additionalProperties: true
          description: Array of result objects returned by the cmdlet
        '@odata.nextLink':
          type: string
          format: uri
          description: URL to retrieve the next page of results
  parameters:
    AnchorMailboxHeader:
      name: X-AnchorMailbox
      in: header
      required: true
      description: Routing hint header used to route the request to the correct backend server. Specify the UPN or primary SMTP address of a mailbox in the target tenant.
      schema:
        type: string
  securitySchemes:
    oauth2:
      type: oauth2
      description: OAuth 2.0 authorization with Microsoft identity platform
      flows:
        clientCredentials:
          tokenUrl: https://login.microsoftonline.com/{tenant}/oauth2/v2.0/token
          scopes:
            https://outlook.office365.com/.default: Default scope for Exchange Online Admin API