UpdateDocumentSharingInfo REST endpoint returns success but per-recipient status fails with "Attempted to perform an unauthorized operation"

We are observing a regression with the SharePoint REST endpoint used to assign permissions on list items. The HTTP call itself succeeds (200 OK), but the per-recipient status in the response indicates failure for every user. This started intermittently across tenants over the past week, suggesting a phased service-side change.

Endpoint:

POST {siteUrl}/_api/web/lists(guid'{listId}')/items('{itemId}')UpdateDocumentSharingInfo

Observed behavior:

The top-level response is successful, but each entry in the value array returns:

AllowedRoles: [0],
CurrentRole: 0,
DisplayName: "<DISPLAY_NAME>",
Email: null,
ExpirationDateTimeOnACE: null,
InvitationLink: null,
IsUserKnown: true,
Message: "DocumentSharing: Permission granting failed for recipient: 'i:0#.f|membership|<user>@<tenant>' for an unknown reason.: Attempted to perform an unauthorized operation.",
OtherMails: null,
Status: false,
User: "<USER_NAME>"

Expected behavior:

Each recipient in the value array should be granted the requested permission level on the list item, and Status should be true.

Timeline:

• Last week — first reported on one tenant (others unaffected).
• This week — reproducing on additional tenants.
• The staggered onset suggests a server-side rollout rather than a client/code change on our side. We have not changed our request payload or app permissions.

Context:

• Same payload that worked previously now fails.
• Tested on multiple sites and lists across affected tenants — same result.

Diagnostic headers from a representative failed call:

date: Tue, 28 Apr 2026 04:34:00 GMT
microsoftsharepointteamservices: 16.0.0.27208
request-id: [Moderator note: personal info removed]
sprequestguid: [Moderator note: personal info removed]
splogid: [Moderator note: personal info removed]
x-sharepointhealthscore: 3
spclientservicerequestduration: 892
content-type: application/json;odata=minimalmetadata;streaming=true;charset=utf-8

Questions:

1. Has there been a recent service-side change to UpdateDocumentSharingInfo or to the permission model it relies on (e.g., a tightening around App-Only contexts or sharing capabilities)?
2. Is this endpoint still supported, or is there a recommended replacement (Graph API equivalent) we should migrate to?
3. Is there a known issue / Service Health advisory tracking this? If so, could someone point to the ID?

Any guidance or pointers to a roadmap/release note would be appreciated.