We have a SharePoint 365 environment with a hierarchy of subsites created. We have also deployed an app to one of the subsites. In the app's home page, we are trying to access a list on the top site, projects master list, via client object model. This is throwing the following error:

access denied. you do not have permission to perform this action or access this resource.

Here is the App.js code. There is a button on the form with "onclick=Init()":

var appContext;
var appWeb;
var hostWebUrl;
var appWebUrl;
var hostWebContext;
var projectMasterList;

$(document).ready(function () {
SP.SOD.executeFunc('sp.js','SP.ClientContext', function () {



function Init(){


function myFunction(){

hostWebContext=new SP.AppContextSite(appContext,hostWebUrl);
     /*After execution of above line, if I skip to the last line in this function 
(set next statement), this will still throw the access denied exception. If I change the 
above line to use appWebUrl instead of hostWebUrl, This line will not throw the access 
denied exception. Instead, that bit of the next line which is trying to getByTitle
("MyList") will throw the same access denied.*/


function Success(){

function Error(sender,args){



The app has "FullControl" permission set in AppManifest.xml for Site Collection and Web.

Update: This solution was deployed to the same environment before and used to work. As soon as I deployed it again, the app Default.aspx page is giving this error. It seems that there is something wrong with app permissions in the environment or the deployment.

2 Answers 2


Not sure why you're getting the access denied error, but you should be using the cross-domain library, SP.RequestExecutor.js, when trying to SharePoint data from within an app. Try calling myFunction with the following:

var scriptbase = hostweburl + "/_layouts/15/";
$.getScript(scriptbase + "SP.Runtime.js", function() {
    $.getScript(scriptbase + "SP.js", function() {
        $.getScript(scriptbase + "SP.RequestExecutor.js", myFunction);

If your app page already calls SP.Runtime.js and SP.js, you only need the part for the cross-domain library.

Try the following within your myFunction:

var context = new SP.ClientContext(appweburl);
var factory = new SP.ProxyWebRequestExecutorFactory(appweburl);
var appContextSite = new SP.AppContextSite(context, hostweburl);

projectMasterList = appContextSite.get_site().get_rootWeb().get_lists().getByTitle("MyList");


You can find more details on the cross-domain library here.

  • Thanks @wjervis. I have read that article before. I tried again with your code. It gives the same error. Access Denied. Commented Jun 30, 2014 at 6:48

The solution turned out to be very simple (and strange). It actually did not have anything to do with the code.

Here are the steps I took to regenerate the issue:

  • Create a site collection.
  • Create a sub site in that site collection.
  • Deploy your app to site collection URL (not the sub site's).
  • Browse to the sub site and add the app.
  • Go to the app (which tries to reach a list on the site collection level). Here you will get the above error.

To fix this issue: Go to the sub site click on "..." sign on top right of the app. Click the permissions. Click "Click here to trust this app again".

  • How are you deploying the app? You should be adding the app to an app catalog, and then adding it to whatever site you need to. Side loading of apps is disabled on all sites except the app development site.
    – wjervis
    Commented Jul 2, 2014 at 11:30
  • u saved my day. That was exactly my issue +1 from my side. Thanks Again Commented Jan 17, 2017 at 11:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.