I’ve been trying to do a simple GET REST call from an external website (Dynamics CRM) to a SharePoint Online site. All I want is to list the files from that SharePoint Online folder into an IFrame on my external website.

I’ve tried all the examples provided by Microsoft including their cross domain JS solutions but nothing works. It seems they were all built to work within a SharePoint app. I found a couple of similar questions but not a response. One thing people mentioned that these calls are anonymous and the SharePoint Site should support CORS. Well it is a SharePoint Online and I cannot modify it to “Allow Cross Domain Origin”.

I should use Javascript for this. I noticed that when I am logged into SP Online, I can paste the call (e.g. https://mydomain.sharepoint.com/sites/mysite/_api/web/) and see the metadata but doing the same call from within the Iframe on the webpage I get Not authorized or required CORS.

Any suggestions on this will be greatly appreciated.