onenote-core-workflow-a

name	onenote-core-workflow-a
description	Full CRUD lifecycle for OneNote notebooks, section groups, sections, and pages via Graph API. Use when building notebook management features, creating page hierarchies, or working with XHTML content. Trigger with "onenote crud", "onenote page management", "onenote notebook workflow".
allowed-tools	Read, Write, Edit, Bash(npm:*), Bash(pip:*), Grep
version	1.6.0
license	MIT
author	Jeremy Longshore <[e-mail]>
tags	["saas","onenote","microsoft"]
compatibility	Designed for Claude Code

OneNote — Full CRUD Lifecycle (Notebooks, Sections, Pages)

Overview

OneNote's hierarchy — Notebook, Section Group, Section, Page — maps cleanly to Graph API endpoints, but the implementation has sharp edges. Section groups created via API sometimes don't render in the desktop client. Page content must be strict XHTML with self-closing tags, and the HTML you send in differs from the HTML you get back. This skill covers the full create/read/update/delete lifecycle with production-safe patterns for every level of the hierarchy.

Key pain points addressed:

• Page content requires XHTML (all tags must close, UTF-8 encoded, no rowspan/colspan)
• Section groups support API nesting depths that the desktop app cannot render beyond two levels
• Output HTML from GET /pages/{id}/content contains Graph-injected data-id attributes and rewritten image URLs that differ from your input HTML
• PATCH page updates use a JSON array with target/action/content — not raw HTML

Prerequisites

• Azure app registration with delegated permissions: Notes.ReadWrite or Notes.ReadWrite.All
• App-only auth deprecated March 31, 2025 — use delegated auth only (DeviceCodeCredential or InteractiveBrowserCredential)
• Python: pip install msgraph-sdk azure-identity
• Node/TypeScript: npm install @microsoft/microsoft-graph-client @azure/identity @azure/msal-node

Instructions

Step 1 — Authenticate with Delegated Credentials

TypeScript:

import { Client } from "@microsoft/microsoft-graph-client";
import { TokenCredentialAuthenticationProvider } from "@microsoft/microsoft-graph-client/authProviders/azureTokenCredentials";
import { DeviceCodeCredential } from "@azure/identity";

const credential = new ({
  : process..!,
  : process..!,
});
 scopes = [];
 authProvider =  (credential, { scopes });
 client = .({ authProvider });