SharePoint

Put your SharePoint sites in a flow: read and write list items, and upload, move and share files in document libraries with the action node, and fire a flow when an item or a file is created, updated or deleted with the trigger. The action node can also be handed to an AI Node as an AI toolkit.

Connect an account

Click Connect SharePoint — in the node's credential picker or in Settings → Credentials — and sign in with a Microsoft work or school account. Microsoft asks you to allow HostWebhook to read and change the lists and files of the SharePoint sites the account can open, and to create lists. The node acts as that account: it sees the sites, lists and libraries the account sees, and nothing else — and it can only change what the account can edit.

ℹWork or school accounts only. Personal Microsoft accounts (outlook.com, hotmail.com) have no SharePoint sites. It is also its own connection: the OneDrive credential doesn't work here, and this one doesn't reach the account's own OneDrive, mail or calendar.

Organizations that require an administrator to approve new apps show a request screen instead: an admin approves HostWebhook once, in Microsoft Entra.
Revoking. Remove HostWebhook from myapps.microsoft.com and the credential stops working; Reconnect it from Settings → Credentials.

The action node

Twenty operations, in three groups.

Group	Operation	What it does	SharePoint
Sites	Search sites	The sites the account can open, by name.	reads
Sites	Get site	One site: its name, address and description.	reads
Lists	List items	The items of a list with their columns, optionally only those where a column has a value.	reads
Lists	Get item	One item with all its columns.	reads
Lists	Create item	A new item, with the columns you fill in.	writes
Lists	Update item	Only the columns you fill in change.	writes
Lists	Delete item	It goes to the site's recycle bin.	deletes
Lists	List lists	The site's lists with their IDs.	reads
Lists	Create list	A new list, with text columns if you name them.	writes
Lists	List columns	A list's columns: the name you see, the internal name, the type, and whether it's required.	reads
Libraries	List folder	The files and folders in a folder of a library.	reads
Libraries	Search files	Files of a library whose name or content contains some words.	reads
Libraries	Get file	One file: name, path, size, who changed it and when.	reads
Libraries	Upload file	A file from the flow, into a folder. If one with that name exists: fail, keep both or replace it.	writes
Libraries	Download file	A copy in HostWebhook, for the next node to attach, read or upload.	reads
Libraries	Create folder	A new folder.	writes
Libraries	Move file	To another folder of the same library, and/or with a new name.	writes
Libraries	Delete file	It goes to the site's recycle bin.	deletes
Libraries	Create share link	A view or edit link, for people in the organization or anyone with the link.	writes
Libraries	List libraries	The site's document libraries with their IDs.	reads

Picking a site, a list, a library and a folder

You pick the site from the ones the account can open, and then its list or its library and folder from that site. Changing the site clears what you picked inside it. Left empty, the library is the site's default one (Documents) and the folder is the top of the library. Refresh reloads a picker after you create something in SharePoint. To take any of them from the flow instead, choose Type an ID or a template under the picker — a site also takes its address, like https://contoso.sharepoint.com/sites/sales, and a folder its path, like /Invoices/2026.

Writing columns

Create item and Update item take the columns one per line, as column: value, and every value takes a template:

Title: {{payload.company}}
Status: New
Amount: {{payload.amount}}
Contact: {{payload.email}}

Use the name you see in SharePoint or the column's internal name — List columns shows both. Number and yes/no columns are converted; a JSON object works too. Title is usually required.

Files

Upload file takes a file from the flow — {{payload._file}}, or one of an email's {{payload.attachments}} — one per run. Download file keeps a copy in HostWebhook, up to your plan's file size, for the next node. A file read from a library has the same shape as one read from OneDrive.

⚠Deleting an item or a file happens for real on every run — Run test included. SharePoint keeps it in the site's recycle bin, from where a site owner can restore it. Point the first tests at a list or a library made for testing.

AI toolkit mode

Once the account is connected, the node asks for a Mode. AI toolkit turns it into eighteen tools that an AI Node — or an MCP client, through one of your MCP servers — calls by name. Uploading and downloading files stay in single operation: they move files of the flow, and a model has none to pass.

Tool	Arguments
search_sharepoint_sites	query? · max_results?
get_sharepoint_site	site_id
list_sharepoint_lists	site_id
create_sharepoint_list	site_id · name · description? · columns?
list_sharepoint_columns	site_id · list_id
list_sharepoint_items	site_id · list_id · filter_field? · filter_value? · max_results?
get_sharepoint_item	site_id · list_id · item_id
create_sharepoint_item	site_id · list_id · fields_json
update_sharepoint_item	site_id · list_id · item_id · fields_json
delete_sharepoint_item	site_id · list_id · item_id
list_sharepoint_libraries	site_id
list_sharepoint_folder	site_id · library_id? · folder? · max_results?
search_sharepoint_files	site_id · library_id? · query · max_results?
get_sharepoint_file	site_id · library_id? · file_id
create_sharepoint_folder	site_id · library_id? · folder? · name
move_sharepoint_file	site_id · library_id? · file_id · folder? · new_name?
delete_sharepoint_file	site_id · library_id? · file_id
create_sharepoint_share_link	site_id · library_id? · file_id · type · scope

What you control

Deleting starts blocked. Unblock delete_sharepoint_item or delete_sharepoint_file in the node's tool list if the agent should have them. Any other tool can be blocked the same way — creating items or share links, for an agent that should only read.
Sites. The model finds a site with search_sharepoint_sites and passes its ID; a tool called without library_id works on the site's default library.
Characters per call sent to the model. 20,000 by default. Lists that don't fit are cut whole items at a time, with a notes field saying how many were left out.

Testing a tool

⚠Only a tool call picks the tool. In AI toolkit mode, only an AI Node, an MCP client or a voice agent chooses which tool the node runs. Run Test, a flow or a webhook run the operation saved on the node: an operation in their payload that names another tool is refused.

✦To try a tool, call it from an AI Node or from an MCP client. Its arguments look like this:

jsonA tool call

{ "operation": "search_sharepoint_sites", "query": "sales" }

⚠A node in toolkit mode is not part of the pipeline. Events arriving through connections made before you switched are refused — the node only runs the tool it is asked for.

The trigger

Pick a SharePoint credential, the site, and what to watch:

A list — fires on Item created, Item updated (any of its columns) and Item deleted.
A document library — optionally one of its folders, subfolders included — fires on File created, File updated (its content, its name or where it is) and File deleted.

Pick one or more events, and optionally only items or files whose name contains something (upper or lower case). The events and the name filter can change while the trigger is active; a different site, list, library or folder needs Apply changes.

Activating subscribes with Microsoft. Microsoft only says that something changed; HostWebhook then reads what changed since the last time. Each notification carries a secret that belongs to this trigger, and HostWebhook checks it before reading anything. Each state of an item or a file is delivered once. Deactivating deletes the subscription.

ℹMicrosoft's notifications can be late — usually a few minutes, sometimes more. HostWebhook also checks every 30 minutes on its own, so nothing is missed for long, and renews the subscription before it expires. If Microsoft refuses a subscription (for example because another trigger already watches the same list with the same account), the trigger shares that one, or checks every 5 minutes.

What the trigger sends downstream

The same item the action node's Get item returns, with what happened and where in front — a flow reads {{payload.fields.Title}} the same way from either:

{
  "event": "itemCreated",
  "service": "sharepoint",
  "id": "12",
  "siteId": "contoso.sharepoint.com,2c712604-…,2d2244c3-…",
  "listId": "22e03ef3-6ef4-424d-a1d3-92a337807c30",
  "title": "Northwind Traders",
  "fields": { "Title": "Northwind Traders", "Status": "New", "Amount": 12500 },
  "url": "https://contoso.sharepoint.com/sites/sales/Lists/Leads/DispForm.aspx?ID=12",
  "createdAt": "2026-10-12T15:04:05Z",
  "createdBy": { "name": "Sam Rivera", "email": "sam.rivera@contoso.com" },
  "lastModifiedAt": "2026-10-12T15:04:05Z",
  "lastModifiedBy": { "name": "Sam Rivera", "email": "sam.rivera@contoso.com" },
  "site": "Sales",
  "list": "Leads",
  "deleted": false
}

A file arrives with the same shape as OneDrive's: name, path, size, mimeType, webUrl, who changed it and when, plus site and library. An item or a file is created if it appeared since HostWebhook last read the changes; one that is edited right after appears once, as created.

A deleted item or file arrives with deleted: true. Microsoft only tells its ID, so the name is the one HostWebhook last knew — it remembers every item or file it sees change after you activate.

Update it or reply to it with the action node using {{payload.id}}, {{payload.siteId}} and {{payload.listId}} (or {{payload.driveId}} for a file).

Trying it out

The trigger's Test push reads the latest changed items or files, applies your filters, and shows them exactly as a delivery will arrive — without running the flow. A deletion can't be sampled; its example shows the shape. To see a real one, activate the trigger and add an item to the list or a file to the library.

Good to know

Busy or throttled

Microsoft limits how fast one account can be called. When it answers that it is busy, the node waits the time it asks for (up to ten seconds) and tries once more before giving up with Microsoft's message.

Filtering by a column

List items can return only the items where a column has a value. On a very large list, SharePoint may refuse to filter by a column that isn't indexed — index it in the list settings.