Take the 2-minute tour ×
SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. It's 100% free, no registration required.

I'm trying to do an AJAX SOAP call to the Lists web service, specifically UpdateListItems. The query isn't malformed, and is working appropriately when using a user with full permissions. When a user with contribute permission tries the query below (and the list being written to is properly permission), I get a 403 error. Are UpdateListItems permissions set elsewhere, such as the web.config file?

UPDATE 1

I am using jQuery to make the AJAX call. Following is the code used:

       var query = '<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">\
        <soap:Body>\
            <UpdateListItems xmlns="http://schemas.microsoft.com/sharepoint/soap/">\
            <listName>{2C3F42BF-A33D-478A-A06E-2342FFC9F3F8}</listName>\
                <updates>\
                    <Batch OnError="Continue">\
                        <Method ID="1" Cmd="New">\
                            <Field Name="Title">email@email.com</Field>\
                            <Field Name="Name">My Name</Field>\
                            <Field Name="Date"></Field>\
                        </Method>\
                     </Batch>\
                </updates>\
                </UpdateListItems>\
            </soap:Body>\
        </soap:Envelope>';
        $.ajax
        ({
            url: "/_vti_bin/lists.asmx",
            beforeSend: function(xhr) { xhr.setRequestHeader("SOAPAction", "http://schemas.microsoft.com/sharepoint/soap/UpdateListItems"); },
            type: "POST",
            dataType: "xml",
            data: query,
            complete: processResult,
            contentType: "text/xml; charset=\"utf-8\""
        });
share|improve this question

2 Answers 2

403 signifies that request was a legal, but the server is refusing to respond to it. Have you try setting ListVersion and ViewName attribute of Batch element, before sending the request?

For e.g.

<Batch OnError="Continue" ListVersion="1" 
ViewName="270C0508-A54F-4387-8AD0-49686D685EB2">
   <Method ID="1" Cmd="New">
      <Field Name='ID'>New</Field>
      <Field Name="Title">Value</Field>
      <Field Name="Date_Column">2007-3-25</Field>
      <Field Name="Date_Time_Column">
         2006-1-11T09:15:30Z</Field>
   </Method>
</Batch>

You can also dig into UpdateListItemsResponse to further refine the error code.

share|improve this answer
    
I just tried updating the batch with both the ListVersion and ViewName, but it still returns the same 403 error. The response XML is ==== XML Parsing Error: syntax error Location: moz-nullprincipal:{7163da59-14d5-4cad-a155-a51cafa23e98} Line Number 1, Column 1: 403 FORBIDDEN. ===== If the user has full control, they're able to use this webservice without error. There must be settings that require a high permission level to initiate the call? –  Eric Di Bari Oct 3 '11 at 20:15
    
Are you using jQuery to place AJAX SOAP call? Could you please paste the whole code? –  Falak Mahmood Oct 3 '11 at 21:15
    
I am using jQuery. I've updated my question to include the code for the AJAX call. –  Eric Di Bari Oct 3 '11 at 21:28

I seem to have found the solution. The user's permission level was missing the site permission Use Remote Interfaces. SharePoint defines it as

Use SOAP, Web DAV, or SharePoint Designer interfaces to access the Web site.

It makes perfect sense now that I look at it. I admittedly don't know enough about SharePoint permissions, and didn't know it was that fine-grained. I just assumed that if a user had write permissions for a list, they could write to it using any protocol.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.