SharePoint Webhook not working with Power Automate HTTP Trigger New URL

[OverkillTV]

Target SharePoint environment

SharePoint Online

What SharePoint development model, framework, SDK or API is this about?

SharePoint REST API

Developer environment

Windows

What browser(s) / client(s) have you tested

• 💥 Internet Explorer
• 💥 Microsoft Edge
• 💥 Google Chrome
• 💥 FireFox
• 💥 Safari
• mobile (iOS/iPadOS)
• mobile (Android)
• not applicable
• other (enter in the "Additional environment details" area below)

Additional environment details

• Same HTTP flows are imported in two environments

Describe the bug / error

Subscribe SharePoint list webhook does not work with new HTTP trigger flow.
When SharePoint tries to validate the URL, it doesn't include the query validationtoken for the new URL.

Using the old URL as validate URL is still working correct so there is no changes in the flow itself.

Steps to reproduce

1. Send a POST to SharePoint REST API to register for list webhook
2. The notification in the body of the POST request is the new URL of HTTP Trigger Flow
3. Observe SharePoint calls to the flow without validationtoken

Expected behavior

When SharePoint calls to the flow new URL, it should includes validationtoken in query for new subscriptions

[Ashlesha-MSFT]

Hello @OverkillTV,
Thank you for bringing this issue to our attention. We will look into it and get back to you shortly.

[Ashlesha-MSFT]

@OverkillTV,
I'm trying to reproduce this issue internally for validation, but I'm running into a few roadblocks and wanted to confirm if I'm missing anything. Here's what I've done so far:

Environment Setup:

SharePoint Online (site: https://TENANT.sharepoint.com/sites/devsite)
List ID: --
Power Automate Flow with HTTP Trigger (new URL format)

What I Tried:

Registered webhook via:

POST /_api/web/lists(guid'--')/subscriptions
Host: TENANT.sharepoint.com

With body:

{
"resource": "https://TENANT.sharepoint.com/sites/devsite/lists/Tasks",
"notificationUrl": "",
"expirationDateTime": "2025-09-25T23:59:59.000Z",
"clientState": "test123"
}

Tried multiple tokens via Azure CLI, and app-registered tokens

Always getting 401 Unauthorized even with token from:
az account get-access-token
Custom Azure AD app with Sites.FullControl.All and admin consent

• Could you confirm if your webhook registration was successful (i.e. 200 OK)?
• If possible, could you share a sample notificationUrl format that worked vs failed?
• What kind of access token did you use to register the webhook?

[OverkillTV]

Hi @Ashlesha-MSFT ,

I'm sending the POST using Power Automate (also tried with SPFx for same result) below is the info:

const apiEndpoint = `[Site URL]/_api/web/lists('[LIST ID]')/subscriptions`;
const newURL = `[New HTTP URL]`;
const rsSub = await this.context.httpClient.post(apiEndpoint, HttpClient.configurations.v1,{
      headers: {
        'Accept': 'application/json',
        'Content-type': 'application/json',
        'X-RequestDigest': [Web Digest],
      },
      body: JSON.stringify({
        "resource": "[Site URL]/_api/web/lists('[LIST ID]')",
        "notificationUrl": newURL,
        "expirationDateTime": "2026-03-14T16:42:56.5172064Z",
        "clientState": "ASADD"
      })
});

One more thing I have found out is that this error happens on one of my client tenant but not all of them. The one that has issue is having the warning message when opening their HTTP flows.

Due to this is PROD environment so I'm limited in testing but I'll see if I can create another "Anyone" HTTP Flow to try out.

[OverkillTV]

I created a new HTTP trigger flow and the error still exists if I try to use the new URL as SharePoint list webhook notification URL.
The old URL which shows on the warning message worked though.

[Ashlesha-MSFT]

@OverkillTV,
We've reviewed the behavior, and based on your findings and our internal checks, it looks like the issue is limited to a specific tenant. The same Power Automate HTTP-triggered webhook setup works correctly in other environments, and the issue with the missing validationToken only appears when using the new-style HTTP trigger URLs on the affected tenant.

We're going to escalate this to the engineering team for further investigation to see if there's a backend or platform change affecting webhook validation in this tenant.

We’ll keep you updated as we hear back from engineering. Please let us know if there’s anything else you observe in the meantime.

[OverkillTV]

@Ashlesha-MSFT

I sent a request directly to the new URL of the HTTP-triggered flow using Postman and the query "validationToken" is also filtered out for some reason. So the issue is not from SharePoint but from how the new URL in Power Automate handles the query parameters.

Request from Postman contains validationToken and additionalQuery:

On Power Automate flow there is no query for validationToken or additionalQuery:

Note that this HTTP-triggered flow is configured for "Anyone". I'll try to see if It works differently if I change it into "Any user in the tenant"

[OverkillTV]

I tried with an "Any user in my tenant" flow and it behaved the same way.

One thing I notice is the header "x-ms-igw-external-uri" and "x-ms-igw-raw-target" does contains the query/parameters but it got trimmed/filtered by Power Automate.

[OverkillTV]

Same issue also reported on Power Platform community:
https://community.powerplatform.com/forums/thread/details/?threadid=b4afdc35-bc8c-f011-b4cc-7c1e527f8bbe

https://community.powerplatform.com/forums/thread/details/?threadid=13a51cf4-7389-f011-b4cb-7c1e52fdfc34

[OverkillTV]

This seems to be a known issue for now: https://admin.powerplatform.microsoft.com/knownissues/5532852

The ETA is Sep 24th so will check back after that.

[renewables-blake-burns34]

Thank you @OverkillTV for creating this issue and @Ashlesha-MSFT for responding. I am also experiencing this exact bug!!!