#provisioning 32 articles
AddValidateUpdateItemUsingPath answers 200 when it creates nothing — while a write to a missing column is a loud 400 gotchas / rest-api Field errors sit inside a 200 and no item is created; a write to a missing column is a 400 on every path, never a silent drop fields/getbyinternalnameortitle returns 400, not 404, for a missing field gotchas / rest-api It throws ArgumentException (HTTP 400), not 404; an existence-check that hard-fails on non-404 breaks the "field missing → create" path, and one that creates on any non-200 duplicates the column when throttled getfolderbyserverrelativeurl returns 200 for a folder that does not exist gotchas / rest-api It answers HTTP 200 with {"Exists": false} (and ListItemAllFields 200 with {"odata.null": true}), so a check on response.ok skips creating the folder and the next call 404s inside breakroleinheritance; measure the… A Choice value your field does not know is stored anyway — so a drifted vocabulary never announces itself gotchas / lists No 400, no error to swallow: a drifted vocabulary never shows at runtime; machine-check the type-to-schema contract A column called MyField0 appears — a throttled existence check or two web parts provisioning at once gotchas / rest-api POST /fields with a taken name succeeds with a numeric suffix; 429 read as "missing", a cached check or two concurrent web parts each make a twin — three-state check, single run per site, name check after the create A library with NoCrawl returns nothing from Search — and silently blinds anything built on Search gotchas / search Excluded containers return 0 with HTTP 200 and no log, so Search-backed AI never sees them; provisioning that excludes data lists must not inherit that onto content libraries; reindex can't be forced over REST… A library your app provisions inherits the web's write permissions — and that is how an AI grounding source gets poisoned gotchas / security Any member can upload over REST and poison an AI grounded on that library; WriteSecurity: 4 does not fix it (Edit includes Manage Lists and bypasses item-level settings) — only unique permissions on the library do A new Choice value in your provisioning code never reaches already-deployed sites gotchas / rest-api Create-if-missing never updates an existing field; a new Choice value in the manifest no-ops on deployed sites; reconcile with a post-hook SP.FieldChoice MERGE (plain JSON with @odata.type under SPHttpClient) that only… A provisioned list with ReadSecurity=2 looks perfect to an admin and empty to everyone else gotchas / lists ReadSecurity=2 looks perfect to an admin and empty to everyone else; WriteSecurity=2 breaks collaborative edits only A provisioning step gated on success runs forever for every non-admin gotchas / spfx A startup step needing ManageLists writes no marker for ordinary members, so the whole batch replays on every page load; the marker needs two states A setup marker that measures only part of the step freezes a half-provisioned site forever gotchas / spfx The success flag measured the id lookups, not the addroleassignment POST, so a 403 froze a site with groups that carry no permission level at all A SharePoint group created by code hides its own membership — and Full Control does not get you in gotchas / security sitegroups POST defaults to OnlyAllowMembersViewMembership: true, so only a member or the account that ran provisioning can read the members; Full Control does not help and identical permission masks prove it Breaking inheritance without copying keeps only YOU — and the re-grant forgets custom groups gotchas / permissions copyRoleAssignments=false leaves exactly one role assignment (the caller), so re-granting Owners/Members/Visitors drops every direct grant and custom group; and an account that loses a configuration read can end up… createfieldasxml ignores Name/StaticName — the internal name is derived from DisplayName gotchas / lists createfieldasxml on a list ignores Name/StaticName unless you pass Options: 8 (AddFieldInternalNameHint); otherwise the internal name is escaped from the label – create with ASCII and rename, or use the hint to keep a… Creating a team right after creating its Microsoft 365 group returns 404 — retry only the 404, and don't log the failure as success gotchas / graph PUT /groups/{id}/team fails with 404 for minutes after POST /groups (replication); retry only 404, surface a real failure as a warning Creating a Teams channel returns 201 long before its SharePoint folder exists gotchas / graph POST /channels returns 201 while SharePoint provisions the folder minutes later; never hand-make the folder, report the pending state and let an idempotent rerun finish it HasUniqueRoleAssignments proves the break, not the hardening — and a half-done break is worse than inheritance gotchas / permissions The flag is true after the break alone, so verifying on it reports "hardened" over a list whose trim never ran; with the safe copy=true form that state is worse than inheritance. Read roleassignments and measure… Limited Access cannot be granted — the API returns 200 and does nothing gotchas / permissions RoleTypeKind: 1 is derived, not assignable: SharePoint maintains it so people can traverse to a child with unique permissions, and an explicit addroleassignment returns 200 while doing nothing. Strip it from EVERY… List item IDs are never reused after a purge — but a recreated list starts at 1 again gotchas / lists Purging a list does not rewind its counter, so orphaned rows in a derived list are dead weight; a recreated list restarts at 1 and turns them into wrong-item attributions Looking up a field that does not exist returns 400, not 404 gotchas / rest-api fields/GetByInternalNameOrTitle on a missing field answers 400; test existence with a $filter instead Multi-line text in a document library stops at 255 characters gotchas / lists A REST MERGE stores 70k characters, but ValidateUpdateListItem rejects anything over 255 unless the column has UnlimitedLengthInDocumentLibrary – set it at creation or PATCH it later Narrowing a principal to Read — "already reads" checked before stripping write leaves it with nothing gotchas / permissions Edit and Contribute contain the View bit, so a "does it already read?" check passes, Read is never added, and the step that removes the write binding then removes the only binding that carried read access — the… POST /fields rejects a subtype property like RichText unless the body names the subtype gotchas / rest-api { FieldTypeKind: 3, RichText: false } without @odata.type is read as SP.Field and fails with 400 – plain text columns in the same loop succeed, so the list ends up half-built; use CreateFieldAsXml or annotate the type Provisioning folder trees at scale in SharePoint Online guides What creating 86 folders and breaking inheritance really costs (no throttling), the alias-parameter syntax, reading a whole tree with one item query (two calls) instead of ninety, and copyRoleAssignments=false silently… Retrying a write without the "new" columns on any 400 silently loses data — drop only the column the error names gotchas / rest-api When one new column is missing, a group-wide retry drops the ones that exist too; drop only the fields the error names as not existing, loop, and tell the user what was left out Seed idempotency must key on the item, not the collection gotchas / lists A per-SET presence check re-inserts the whole block; SharePoint cannot enforce a unique set + value pair, and two app starts at the same moment still race – after inserting, re-read and delete your own copies that are… Telling a list's own columns from inherited ones — Hidden is not enough gotchas / rest-api Hidden is not enough; FromBaseType + CanBeDeleted are what separate the list's own columns The browser cache answers your read-after-write check — with a 200 gotchas / rest-api The same URL read on both sides of a write is served from the browser cache, so res.ok guards pass on stale state; a cached existence check makes POST /fields create a duplicate column and report success, and an… The hosted workbench restores your web parts on the next site you open in the same tab gotchas / spfx The hosted workbench keeps its canvas in sessionStorage per tenant origin, not per site; open another site's workbench in the same tab and your web part boots there — with that site's pageContext, so first-run… Title and Created are the fields you filter on — and the ones your provisioning code never indexes gotchas / lists Provisioning indexes only the columns it creates, so the most-filtered fields stay unindexed; past 5,000 items the read throttles and a swallowed error in a write path stops all writes silently Version-gated provisioning silently drops the settings only an admin could write gotchas / lists A settings PATCH needs Manage Lists; the first member to open the app after an upgrade burns the one attempt and the version is stored anyway View counts and ratings written by readers cannot live in a list only editors may write gotchas / lists Views and ratings are written by the reader, so on a WriteSecurity: 4 content list every click is a swallowed 403 while the UI says thanks