Epona365 API Proxy

Audience: Consultants and M365 admins deploying Epona365 Web together with the Epona365 API.

By default, Epona365 Web calls Microsoft Graph and SharePoint directly from the browser, using the permissions approved for the SharePoint Online Client Extensibility Web Application Principal (see Permissions Reference).

When the proxy is enabled, Epona365 Web sends all Graph and SharePoint calls to the Epona365 API instead. The Epona365 API exchanges the user's token (on-behalf-of) and forwards the request to Microsoft Graph or SharePoint. Every call still runs as the signed-in user — the user can never see or change more than their own permissions allow.

Because the Epona365 API makes the Graph call, the Graph permissions that count are the ones granted to the Epona365 API app registration, not the ones approved in the SharePoint Admin Center. A feature that works without the proxy can therefore stop working once the proxy is on, until the matching permission is granted to the Epona365 API app.

Requirements

• The Epona365 API is deployed and its URL is set in the DMS configuration (api.url).
• The access_as_user permission of the Epona365 API is granted to the SharePoint Online Client Extensibility Web Application Principal — see access_as_user.
• In addition to the Graph and SharePoint permissions it already has, the Epona365 API app registration has the Graph permissions listed in Permissions per feature, with admin consent granted.

Configuration

In the DMS Configuration Center, open Epona365 Web → Epona365 Office and enable Route Graph and SharePoint calls through the Epona365 Office API. It is off by default.

Warning: Once active, the proxy is the only route to Graph and SharePoint — failed proxy calls are not retried directly. If access_as_user is not granted, or the Epona365 API becomes unreachable during a session, all document operations fail. Enable it only after the Epona365 API is deployed and the permissions below are granted.

If the Epona365 API cannot be reached when Epona365 Web loads, an "Office service is unavailable" error is shown and Epona365 Web calls Graph and SharePoint directly for that session.

If api.url is empty, the setting has no effect and Epona365 Web keeps calling Graph and SharePoint directly.

Permissions per feature

Grant these as Delegated Microsoft Graph permissions on the Epona365 API app registration (Entra admin center → App registrations → Epona365 API → API permissions), on top of the permissions the app already has, then click Grant admin consent.

Feature	Permission on Epona365 API app	When it is needed
Planners (Tasks folder)	Tasks.Read.Shared	Only when the plan is auto-discovered. Not needed when the matter has a Planner URL set.
Channels (Teams folders)	Channel.ReadBasic.All	Always, to list the Teams channels of the matter's M365 group.
Notebooks	—	No extra permission. Notebooks are found through SharePoint, not through Graph.

Planners (Tasks)

A matter shows a Tasks folder when a Planner plan can be found for it — see Planners (Tasks). There are two ways a plan is found:

• Planner URL on the matter — when plannerUrlColumnName is configured and the matter has a value in that column, that URL is opened directly. No Graph call is made, so this works through the proxy without any extra permission.
• Auto-discovery — otherwise Epona365 looks up the Planner plans of the matter's M365 group. Through the proxy this requires Tasks.Read.Shared on the Epona365 API app. Without it, the lookup is denied and the Tasks folder does not appear.

Channels

The Teams channels of the matter's M365 group are shown as folders in the root of the matter. Through the proxy, listing them requires Channel.ReadBasic.All on the Epona365 API app. Without it, the channel folders do not appear; the rest of the matter keeps working.

Notebooks

The Notebooks folder (see Configuration → Notebooks) finds OneNote notebooks in the matter's document library and Site Assets through SharePoint. It works through the proxy without any extra permission.

Troubleshooting

Symptom (proxy enabled)	Likely cause
No documents load at all; every action fails	access_as_user not granted, or Epona365 API went down during the session
"Office service is unavailable" error on load	Epona365 API unreachable — proxy inactive, direct calls used for the session
Tasks folder missing, although the group has a plan	Tasks.Read.Shared not granted on the Epona365 API app
Channel folders missing, although the matter has a Team	Channel.ReadBasic.All not granted on the Epona365 API app
Feature works with the proxy off, but not with the proxy on	Graph permission present on SharePoint, missing on the Epona365 API

After granting a permission, reload the page and open the matter again. The channel list is remembered in the browser, so channel folders can take a second open of the matter to appear.