Microsoft To Do rejects $select — 400 invalidRequest / RequestBroker--ParseUri

Symptom

Creating a task (POST /me/todo/lists/{id}/tasks) fails with:

HTTP 400 · invalidRequest: Invalid request

The user has a mailbox and a To Do licence, and the code had been in production for months without changes. The error surfaces on the "create" button, so it looks like the POST body is wrong — but the failing request is the list lookup before it.

Cause

Measured on 2026-10-15 on one tenant and one user account (Graph v1.0 and beta, delegated Tasks.ReadWrite) — re-check on yours:

The List lists reference says only that the method "supports some of the OData query parameters", without saying which — so $select is not a documented guarantee. Since the same code had worked before, treat it as a service-side change you must tolerate: don't depend on $select here.

Fix

Don't send $select to To Do; filter fields client-side.

// before: .api('/me/todo/lists').select('id,displayName,wellknownListName').top(50)
const lists = await client.api('/me/todo/lists').top(50).get();

// pick the default list; skip "Flagged Emails" in the fallback — it holds tasks made from flagged mail (Microsoft docs), not a place for a new to-do
const def = lists.value.find(l => l.wellknownListName === 'defaultList')
  ?? lists.value.find(l => l.wellknownListName !== 'flaggedEmails');

const open = await client
  .api(`/me/todo/lists/${encodeURIComponent(def.id)}/tasks`)
  .query({ $filter: "status ne 'completed'" })   // still supported
  .top(50)                                         // still supported
  .get();

Notes

• Measure, don't guess. A first theory here was the due-date time zone (dateTimeTimeZone docs list Windows zone names; Europe/Prague is not among the examples). It was plausible, shipped — and changed nothing. Splitting the request parameter by parameter found the real cause in minutes.

• Getting a Graph token from the browser console without an app registration: on a modern SharePoint page (the classic /_api/SP.OAuth.Token/Acquire refuses https://graph.microsoft.com with "Resource is not allowed"):

  const ml = await window.moduleLoaderPromise;
  const provider = await ml.context.aadTokenProviderFactory.getTokenProvider();
  const token = await provider.getToken('https://graph.microsoft.com');
  const r = await fetch('https://graph.microsoft.com/v1.0/me/todo/lists?$select=displayName',
    { headers: { Authorization: 'Bearer ' + token } });
  console.log(r.status, await r.json());

  The token carries the scopes granted to SPFx in your tenant and runs as the signed-in user — read-only probing is safe; don't POST test data you won't clean up.

• Error copy: a 400 on a request URL or body is not "missing mailbox or licence". Reserve that hint for 404/403 on reads (see todo-requires-exchange-mailbox).