Case study
OneDrive Storage API with Microsoft Graph
A REST API built with Java and Spring Boot that uses Microsoft OneDrive as a file storage layer. The solution integrates Microsoft Graph and OAuth 2.0 to provide file uploads, metadata retrieval, streaming downloads, deletion, and automatic access/refresh token management.
Technologies
The problem
Applications that need file storage typically rely on dedicated object storage services or need to maintain their own storage infrastructure. The goal of this project was to use OneDrive as the storage backend while exposing a custom API that abstracts the complexity of Microsoft Graph authentication, OAuth token management, and file operations.
The solution
A REST API was developed using Java and Spring Boot to act as an intermediary layer between consumer applications and Microsoft OneDrive. The application authenticates with Microsoft through OAuth 2.0 and stores the tokens required to access Microsoft Graph. When an access token expires, the system automatically uses the refresh token to obtain a new credential without requiring manual reauthentication. The API exposes endpoints for uploads, file metadata retrieval, deletion, and downloads. File paths are normalized before operations to keep resources within the configured storage structure. Downloads are streamed directly between OneDrive and the API client, avoiding the need to load the entire file into application memory.
Responsibilities
Responsible for the architecture and implementation of the API, Microsoft Graph integration, OAuth 2.0 authorization flow, access token lifecycle management, and file storage endpoints. Also responsible for multipart upload handling, path normalization, download streaming, validation of Microsoft Graph responses and redirects, global error handling, and OpenAPI documentation.
Technical decisions
Java 17 and Spring Boot were selected to build a strongly typed REST API organized into controllers, services, clients, configuration classes, and DTOs. Microsoft Graph communication was encapsulated within a dedicated client to avoid exposing external API implementation details directly to controllers. OAuth 2.0 was used to authorize OneDrive access with the required scopes. Refresh tokens are persisted and automatically used whenever the access token expires. Streaming downloads were implemented to avoid buffering entire files in memory and to better support larger files. File paths are normalized and resolved inside a configured root folder to reduce unexpected storage access. Microsoft Graph download redirects are handled explicitly, with validation of the provided URI before accessing the temporary download location. OpenAPI documents the available endpoints, while sensitive write operations include an additional API key protection layer.
Results
The project resulted in a reusable storage layer that allows other applications to interact with files stored in OneDrive through a custom REST API without directly handling Microsoft Graph or OAuth details. The solution supports uploads, metadata retrieval, deletion, streaming downloads, and automatic credential renewal. The project also strengthened practical experience with third-party API integration, OAuth 2.0, HTTP streaming, file handling, and REST API architecture with Java and Spring Boot.