Grist vs Microsoft Excel (Microsoft Graph workbook API)

Grist

OAuth tokens carry seven scopes, can be limited to chosen documents and expire after an hour, and the REST API has a public OpenAPI file with an add-or-update call. No status page, SLA terms, DPA or security.txt was found, and the docs say the hosted service has no SOC 2 or ISO 27001 audit.

Microsoft Excel (Microsoft Graph workbook API)

Ranges, tables, charts and 366 worksheet function endpoints are reachable over REST with a public OpenAPI, and a non-persistent session lets an agent test changes without saving them. The reference pages list delegated permissions only, with Files.ReadWrite as the least privileged scope, and writes take no idempotency key.

Grist

1. Connect through OAuth, not an API key. Ask for doc:read alone for reading, and have the user pick Selected resources on the consent screen
2. Keep doc.schema:write off unless needed. The docs say formula editing lets its holder read any data in the document whatever the access rules
3. Send requests for one document one at a time. The eleventh concurrent request gets 429, and no Retry-After header is documented
4. Use PUT /api/docs/{docId}/tables/{tableId}/records with require to add or update by key, so a retried write doesn't create a duplicate row
5. Use the /records endpoints, not the deprecated /data ones, and split large writes to stay under the 1 MB body limit

Microsoft Excel (Microsoft Graph workbook API)

1. Create a session with POST /workbook/createSession and send workbook-session-id on every call. Persistent sessions expire after about 5 minutes idle
2. Set persistChanges to false when you only need a calculation or a chart image, so nothing is saved to the file
3. Send one request at a time per workbook and wait for each response. Microsoft warns that parallel writes cause throttling, timeouts and merge conflicts
4. Add rows in one call with a two-dimensional values array, and check the table before repeating a row add that returned 504
5. Read bounded addresses such as A1:D500. A whole-column range such as C:C returns null for values, and writes to it are refused