Office Outlook Add-In OAuth Error - rest

Question

i'm currently developing an Office Outlook App.
I'm trying to get the messages (specially the Attachments of messages)
from the Exchange Server.
I'm using the Outlook Desktop Application.
I already got the bearer authentication token and i'm trying using the Office REST-API to get the messages, but there is a strange error if i send the GET request to the server.
Error:
"The api you are trying to access does not support item scoped OAuth."
Here is my JavaScript-Code:
Office.context.mailbox.getCallbackTokenAsync(function (asyncResult) {
if (asyncResult.status === "succeeded") {
var authToken = asyncResult.value;
var attUrl = 'https://outlook.office.com/api/v2.0/me/mailfolders/inbox/messages/';
$.ajax({
method: "GET",
url: attUrl,
beforeSend: function (request) {
request.setRequestHeader("Accept", "text/*, application/xml, application/json; odata.metadata=none");
request.setRequestHeader("Authorization", "Bearer " + authToken);
request.setRequestHeader("X-AnchorMailbox", "test#test.de");
},
success: function (responseData) {
console.log("success", responseData);
},
error: function (errData) {
console.log("err", errData);
}
});
}
});
I'm scanning the outgoing traffic and there seems everything ok:
GET outlook.office.com/api/v2.0/me/mailfolders/inbox/messages/ HTTP/1.1
Authorization: Bearer TokenIsCorrect
Accept: text/*, application/xml, application/json; odata.metadata=none
X-AnchorMailbox: test#test.de
Referer: localhost:44300/AddInRead/App/Index/Index.html
Accept-Language: de-DE
Origin: localhost:44300
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Host: outlook.office.com
DNT: 1
Connection: Keep-Alive
Cache-Control: no-cache
.................
I refered to:
Outlook Mail REST-API Reference
and the samples on
Outlook Dev Center OAuth Sandbox
I think i searched the hole internet, but couldn't find anything
to fix this problem.
Hopefully someone can give me the right hint.
BTW: had to remove some links cause of no reputation of my account :/
Thanks !

Answer 1

I found the problem and i was able to fix it.
There is a difference between the Access-Token and the Token you get, if you call the Office.context.mailbox.getCallbackTokenAsync function of the REST-API.
I could see that with logging-in in Outlook Dev Center OAuth Sandbox with my own account, get the token and compare this token with the token i get in VS with getCallbackTokenAsync.
They are different.
The Token from the function is only for getting attachments or items.
In this case i thought "items" are messages and i could start a request for all messages with that token, but wrong.
You have to take the token from the function and address the attachment directly with
https://outlook.office.com/api/v2.0/me/mailfolders/inbox/messages/' + idMail + '/attachments/' + mail.attachments[i].id;
Best regards