> ## Documentation Index
> Fetch the complete documentation index at: https://docs.neoagent.io/llms.txt
> Use this file to discover all available pages before exploring further.
# SharePoint API
> Read SharePoint sites, files, and lists via Microsoft Graph — and write to exactly the sites you allow
The SharePoint API tool gives Neo agents direct access to SharePoint through Microsoft Graph — browse sites and document libraries, read and search files, work with lists and site pages, and (where you allow it) create and update content.
Automatically enabled when you configure SharePoint permissions in your agent workflow. No manual toggle needed. See the [SharePoint integration page](/integrations/documentation/sharepoint) for connection setup and write access.
## What It Does
* List SharePoint sites and their document libraries
* Browse folders, read file metadata, and download file content
* Search files, folders, and pages with the Microsoft Search API
* Read lists, list items, and site pages
* Create folders, upload and update files, and update list items — on write-granted sites only
## Two write gates, by design
Reading is limited to the document libraries you chose to sync. Writing has two further gates on top of that, and both must be open:
1. **Agent permission groups** — you set each group below to Disabled, Read Only, or Read/Write per agent.
2. **Per-site write grants** — a Microsoft 365 admin grants Neo write access site by site, on the [SharePoint integration page](/integrations/documentation/sharepoint). A write to any other site is refused, whatever the agent's permission groups say.
An agent can list your sites and libraries by name wherever they are — that is how it finds the right one, and it returns names only. It can open **file content, folders, lists and pages only inside the libraries under Read access**. Microsoft Search runs across the tenant, and Neo filters the results down to those libraries before the agent sees them.
An agent with Read/Write groups but no site grants can read everything and write nothing. DELETE is never supported, on any site, under any profile.
## Permission Groups
| Permission Group | What It Covers |
| --------------------- | ---------------------------------------------------------------------------------------------------------------- |
| **Sites & Libraries** | Site listing and metadata, document library (drive) metadata |
| **Files & Folders** | Files and folders in document libraries — metadata, content download, uploads and updates on write-granted sites |
| **Lists & Pages** | SharePoint lists, list items, columns, and site pages |
| **Search** | Microsoft Search across SharePoint content (read-only by API design) |
## Access Profiles
All four groups Read Only. The agent can browse and search everything the connector can see, but cannot make changes. The typical setting for documentation-aware ticket-resolution agents.
Files & Folders **Read/Write**; Sites & Libraries, Lists & Pages, and Search Read Only. The agent can create folders and upload or update files on write-granted sites — ideal for agents that maintain runbooks and client documentation — but cannot change site structure or lists.
All four groups Read/Write. Writes still land only on the sites an admin has granted, and DELETE stays blocked.
## Safety Controls
| Control | Behavior |
| ------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **DELETE blocked** | The agent can never delete files, folders, list items, or sites — deletions are done in SharePoint itself. |
| **Per-site write scope** | Microsoft enforces the per-site grants (`Sites.Selected`) below Neo's own code: even a misbehaving request cannot write outside the granted sites. |
| **Read scope** | Agents read only the libraries under **Read access**. Unlike the write scope, Microsoft does not enforce this one — the connector app can technically read the tenant, and Neo's own code holds the line. |
| **Permission surface blocked** | The agent cannot read or change site permission entries — write grants are managed by your admin, never by an agent. |
| **Technician approval** | Each group has a **Require approval** toggle; writes on that group then wait for a technician's sign-off. |
| **Rate-limit pacing** | The tool reads Graph's rate-limit headers and paces itself before SharePoint starts refusing requests. |
## Relationship to other tools
* **[Find Documentation](/agents/tools/search/find-documentation)** searches Neo's synced documentation index, SharePoint content included, one query across every connected source. Prefer it for "find the runbook about X"; use the SharePoint API tool to browse live structure, fetch a specific file, or write.
* **Microsoft 365 (MS Graph API)** also exposes `/sites` and `/drives` under its SharePoint & OneDrive permission group, on the Microsoft 365 integration's own app. The SharePoint API tool works without that integration and is the only one with per-site write scoping.
## Setup
[Connect SharePoint](/integrations/documentation/sharepoint) from the Neo dashboard — a one-time admin consent, then pick the libraries to sync.
For write use, an admin opens **Integrations → SharePoint → Write access** and grants the specific sites the agent may write to.
In the agent builder's **Documentation** section, pick an access profile or set the four permission groups individually.