Contact Deletion API Ignores Validation of Specified Contact Folder ID

Question

We have observed an issue with the Microsoft Graph API for deleting contacts from specific contact folders. The API appears to validate only the contactId during deletion without ensuring that the contact exists within the provided folderId.

Details of the Issue:

• API Endpoint Used: DELETE /me/contactFolders/{{folderId}}/contacts/{{contactId}}
• Observed Behavior: When invoking the API with an incorrect folderId but a valid contactId, the contact is deleted successfully, even if the folderId does not exist or does not contain the contact.
• Expected Behavior: The API should validate that the contact is located within the specified folderId before proceeding with the deletion. If the folderId is incorrect or does not exist, the API should return an error indicating that the contact cannot be found in that folder and prevent deletion.

Answer 1

Hello Test User,

Thank you for reaching out to Microsoft Support!

After testing, as you said, even if folderId is not correct, but contactId is correct, it can be successfully deleted, which is recommended that you give feedback here.

Hope this helps.

If the answer is helpful, please click Accept Answer and kindly upvote it. If you have any further questions about this answer, please click Comment.