An endpoint contract comes before a module command

Your practical task

Build a paginated Graph-style report that detects loops and keeps a failed collection separate from a complete empty result.

You need a user inventory, not permission to change accounts. First shape a supplied sample object locally; then design the optional Graph access. The core exercise requires no tenant and stores no tokens.

How the system works

An API page is not the whole dataset. A next-link indicates more data, and its full URL is part of the service’s paging contract. Treating the first page as complete can produce a convincing but incomplete access or inventory report. In this offline lab the page URLs are keys in a fixture, so you can practise traversal without a tenant or access token.

Pagination also needs a termination rule. If a next-link repeats, a naïve loop can run forever. The HashSet records visited page keys and stops when a key appears twice. That is a collection failure, not permission to return whatever happened to be collected before the loop. Production code should preserve a partial result only when the report explicitly marks it incomplete.

Read-only permissions still need least privilege and approved use. The permission required depends on the endpoint, delegated or application context, and the properties you request. A working sample is not proof that broad directory permissions are necessary. For a live extension, select the exact documented endpoint, review its permission table and token context, and avoid placing tokens in logs or exported CSV files.