REST api 403 (Forbidden) error for creating site

Question

I'm trying hard to make work this code:

shptService.create_board = function (url, title, description, template) {
            //ensure form digest
            shptService.ensureFormDigest(function (fDigest) {

                $.ajax({
                    url: shptService.hostWebUrl+"/_api/web/webinfos/add",
                    type: "POST",
                    data: JSON.stringify(
                          {
                              'parameters': {
                                  '__metadata': { 'type': 'SP.WebInfoCreationInformation' },
                                  'Url': url,
                                  'Title': title,
                                  'Description': description,
                                  'Language': 1033,
                                  'WebTemplate': 'sts',
                                  'UseUniquePermissions': false
                              }
                          }
                      ),
                        headers: { 
                            "accept": "application/json; odata=verbose", 
                            "content-type":"application/json;odata=verbose",
                            "X-RequestDigest": fDigest
                    },
                    success: doSuccess,
                    error: doError
                });


            });
        };

i got from this source : https://msdn.microsoft.com/en-us/library/office/jj164022.aspx#bk_CreateSite but I'm having this error : 403 (Forbidden) .can anybody tell me why i'm getting this problem or a solution is better.

Answer 1

Forbidden Error Generally occours because of these two reasons.

1. Your Form Digest value is not correct.
2. The user you are running tests as doesnt have the requisite permissions.

To solve 1 - use $('#__REQUESTDIGEST').val() to get the form digest value. In case you are not getting/able to resolve the value, you may consider refreshing the form digest value by hitting the /contextinfo endpoint

var getFormDgst= function(url) {

  var req = {};
  req.url = url + "/_api/contextinfo";
  req.method = "POST";
  req.body = "";
  req.header = {
    "Accept": "application/json; odata=verbose"
  };
  req.success = function(data) {

    //get context info from data.
    $('#__REQUESTDIGEST').val(data.d.GetContextWebInformation.FormDigestValue)

  };
  req.failure = function(data, errorCode, errorMessage) {

  }
  $ajax(req);      
}

The case 2 is easier to solve - you just give the requisite permission :)

Source : Wiktor Wilan's Blog