Marketplace Research

Marketplace Research

Microsoft Graph API Documentation Index

Core Productivity

Collaboration

Identity & Access

Security & Compliance

Device Management

Analytics & Reports

Developer & Platform

Graph API Structure Guide

URL Patterns

• v1.0 (stable): https://graph.microsoft.com/v1.0/{resource}
• Beta (preview): https://graph.microsoft.com/beta/{resource}

Common Endpoint Patterns

GET    /{resources}                    # List resources
GET    /{resources}/{id}               # Get a specific resource
POST   /{resources}                    # Create a resource
PATCH  /{resources}/{id}               # Update a resource
DELETE /{resources}/{id}               # Delete a resource
POST   /{resources}/{id}/{action}      # Perform an action

Permission Extraction

When reading a Microsoft Learn API reference page, permissions are listed in a table:

• Delegated (work or school account): permissions for signed-in user context
• Delegated (personal Microsoft account): usually "Not supported"
• Application: permissions for daemon/service context

Always extract both delegated and application permissions.

OData Query Parameters

Pagination

Responses with more results include @odata.nextLink. Follow this URL to get the next page. Delta queries use @odata.deltaLink for incremental sync.

Error Handling

Graph API returns standard HTTP status codes with an error body:

{
  "error": {
    "code": "Request_ResourceNotFound",
    "message": "Resource not found.",
    "innerError": { "request-id": "...", "date": "..." }
  }
}

Common codes: 400 (bad request), 401 (unauthenticated), 403 (forbidden), 404 (not found), 429 (throttled).

Throttling

• Per-app, per-tenant limits vary by service
• 429 responses include Retry-After header (seconds)
• Best practice: implement exponential backoff

Research Output JSON Schema

{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "required": ["service", "displayName", "description", "apiVersions", "baseUrl", "areas"],
  "properties": {
    "service": { "type": "string", "description": "Lowercase service identifier" },
    "displayName": { "type": "string", "description": "Human-readable service name" },
    "description": { "type": "string", "description": "One-line service description" },
    "apiVersions": {
      "type": "array",
      "items": { "enum": ["v1.0", "beta"] }
    },
    "baseUrl": { "type": "string", "format": "uri" },
    "docUrls": {
      "type": "array",
      "items": { "type": "string", "format": "uri" }
    },
    "areas": {
      "type": "array",
      "items": {
        "type": "object",
        "required": ["name", "endpoints"],
        "properties": {
          "name": { "type": "string" },
          "endpoints": {
            "type": "array",
            "items": {
              "type": "object",
              "required": ["method", "path", "description", "permissions"],
              "properties": {
                "method": { "enum": ["GET", "POST", "PATCH", "PUT", "DELETE"] },
                "path": { "type": "string" },
                "description": { "type": "string" },
                "apiVersion": { "enum": ["v1.0", "beta"] },
                "permissions": {
                  "type": "object",
                  "properties": {
                    "delegated": { "type": "array", "items": { "type": "string" } },
                    "application": { "type": "array", "items": { "type": "string" } }
                  }
                },
                "requestBody": {},
                "responseSchema": {},
                "queryParams": { "type": "array", "items": { "type": "string" } },
                "pagination": { "type": "boolean" }
              }
            }
          }
        }
      }
    },
    "patterns": {
      "type": "array",
      "items": { "type": "string" }
    },
    "notes": { "type": "string" }
  }
}

Plugin Scaffold Templates

plugin.json Template

{
  "name": "{plugin-name}",
  "version": "1.0.0",
  "description": "{description}",
  "author": { "name": "Markus Ahling" },
  "keywords": ["{keyword1}", "{keyword2}"],
  "skills": ["./skills/{plugin-name}/SKILL.md"],
  "agents": ["./agents/{service}-reviewer.md"],
  "commands": ["./commands/{cmd1}.md", "./commands/setup.md"]
}

Command Frontmatter Template

---
name: {command-name}
description: {one-line description}
argument-hint: "{usage pattern}"
allowed-tools:
  - Read
  - Write
  - Bash
---

Agent Frontmatter Template

---
name: {Service} Reviewer
description: >
  Reviews {service} integration code for correct API usage,
  permission handling, and security best practices.
model: inherit
color: orange
tools:
  - Read
  - Grep
  - Glob
---

SKILL.md Frontmatter Template

---
name: {Service Display Name}
description: >
  Deep expertise in {service} via Microsoft Graph API — {capabilities summary}.
allowed-tools:
  - Read
  - Write
  - Edit
  - Glob
  - Grep
  - Bash
triggers:
  - {trigger1}
  - {trigger2}
---

Known M365 Services Catalog

This catalog lists Microsoft 365 and Azure services for coverage auditing. Status: covered = plugin exists, partial = some coverage, uncovered = no plugin.

Marketplace Registration Checklist

When adding a new plugin to the marketplace:

1. Plugin structure — verify all files exist:

   • .claude-plugin/plugin.json with valid JSON
   • skills/{name}/SKILL.md with frontmatter
   • commands/*.md with frontmatter
   • agents/*.md with frontmatter
   • README.md

2. Marketplace entry — add to .claude-plugin/marketplace.json:

   {
     "name": "{plugin-name}",
     "source": "./{plugin-name}",
     "description": "{description}",
     "category": "{category}",
     "tags": ["microsoft", "{tag1}", "{tag2}"],
     "strict": true
   }
   

3. CLAUDE.md — add row to the Available Plugins table

4. Validation — run:

   npm run validate:all
   

5. Commit — stage all new/modified files and commit

Progressive Disclosure — Reference Files