I need to update (CRUD) SharePoint list items from a stand alone application outside of SharePoint. This application can only use JavaScript to call SP. Deploying it as an app on SharePoint won't be possible as the client doesn't have the App framework set up properly.

Can anyone help if it is possible to update SharePoint list items from a standalone webapp? and how would I go about handling authentication. Would greatly appreciate any help on this.

  • Is the stand alone app in the same domain as SharePoint? Commented Mar 5, 2015 at 16:15
  • Hi Steve, they are in the same network. the webapplication is running on a webserver separate to sharepoint and has url similar to NetApplication and sharepoint site is running on Intranet.
    – Rammers
    Commented Mar 6, 2015 at 19:49
  • 1
    If both apps are in the same domain the calling app can make a call to sharepoint/_api/contextinfo and get the formdigest value. You can then use this when posting via REST to SharePoint. Commented Mar 7, 2015 at 1:50

4 Answers 4


If the stand alone web application and SharePoint are not in the same domain, the simple answer is that you cannot unless you are using Apps.

The more complex answer is that you would need to have a proxy of some sort to do this. You could write a simple layer 7 proxy inside the non-SharePoint web app that forwards the requests and the authentication or use something like Squid or even IIS itself to do this.

Hi Robert, both applications are in the same network and wouldn't need to make calls across the firewall. Does that make easier to call SP webservices from that html/jquery page?

It's all about the same origin policy, not about networking. Since SharePoint does not support JSONP/CORS, you have to respect the same origin policy. If the systems are not in the same DNS domain (i.e. portal.company.com), then by doing an AJAX call to the SharePoint server would be enabling an XSS attack. The only way to accomplish this scenario without a proxy, would be to introduce serious security vulnerability into the your users' browsers.

Another consideration might be hosting the non-SharePoint site in the same domain as SharePoint.

In order to pass the original user's credentials you'll need to configure the WCF to use Kerberos Constrained Deligation.

  • Thanks Robert. If I were to write a custom WCF service to do this (update List items from External site), would it be possible to do the authentication on SharePoint end then?
    – Rammers
    Commented Mar 6, 2015 at 17:39
  • I updated my answer with a link to an explanation about how to also proxy the authentication. It's not really on topic here as it's not specific to SharePoint, so I didn't go into detail. Commented Mar 6, 2015 at 17:57
  • Hi Robert, both applications are in the same network and wouldn't need to make calls across the firewall. Does that make easier to call SP webservices from that html/jquery page?
    – Rammers
    Commented Mar 6, 2015 at 19:50
  • No, it's got nothing to do with location of the systems on the network. I've updated my answer with an explanation. Commented Mar 6, 2015 at 20:39
  • Is it possible to reverse the scenario, though? Could SharePoint host the page with the HTML and JavaScript and the other app be modified so that it can use CORS or JSONP? Commented Mar 6, 2015 at 21:00

I am advised to provide detailed answer, sorry about it as it was my first post on SharePoint Stack Exchange. The following is my blog link where I added step by step approach how to perform CRUD operations on a List that resides on another on premises farm. Recently working on an assignment I had faced this issue and could not find any end to end solution hence I documented it at on my blog at following url:


In nutshell, following are the steps required to get a list item added, updated or deleted from one farm to another: Its applicable if you have both the farms in same premises.

If Using CSOM:

  1. Get the context for the target site.
  2. Use CSOM to perform CRUD on the target.

function PerformListOperations() {

var clientContext = new SP.ClientContext( "http://sharepointtesting.xxxx.com/teams/SharePoint" );

var oList = clientContext.get_web().get_lists().getByTitle('OAuthTest');

var itemCreateInfo = new SP.ListItemCreationInformation();

this.oListItem = oList.addItem( itemCreateInfo );




clientContext.executeQueryAsync(onPerformListOperationsSuccess, onPerformListOperationsFail);


function onPerformListOperationsSuccess () {
alert("Successfully created an item using CSOM...");


function onPerformListOperationsFail (sender, args) {
alert('Failed to create an item using CSOM... Error:' + args.get_message());


$(document).ready(function () {    
$("#CreateButton").click(function () {              
    SP.SOD.executeFunc('sp.js', 'SP.ClientContext', PerformListOperations);


If Using REST API:

  1. Call ContextInfo REST API call and retrieve FormDigestValue value.

  2. Pass the FormDigestValue to subsequent calls to perform CRUD.

  3. Making sure that metadata type for ListItem is correct, in my case my List Name is "OAuthTestList", the SharePoint adds "ListItem" as suffix to the list name, please refer following code line:

var jsonMetaData = { __metadata: { type: 'SP.Data.OAuthTestListListItem' }, Title: newTitle };

How to get Form Digest: I am calling contextinfo REST api call as shown in following function and retrieving value FormDigestValue from GetContextWebInformation object of response. Please pay attention how I am using "Target SharePoint Farm" URLs in hostUrl and how I am using it to construct the appURL value.

function CreateAListItem(listName, newTitle) {
var formDigest;
var hostUrl = "http://sharepointtesting.xxxx.com/xxxx/SharePoint/oAuth";
var appUrl = hostUrl + "/_api/web/lists/getbytitle('" + _options.listName + "')/items";

$.support.cors = true;
    url: hostUrl + "/_api/contextinfo",
    type: 'POST',
    xhrFields: { withCredentials: true },
    dataType: "json",       
    contentType: "application/x-www-url-encoded",
    headers: {
        "accept": "application/json;odata=verbose"
    success: function (data) {
        if (data.d) {
            formDigest = data.d.GetContextWebInformation.FormDigestValue;               

            // add your logic to add an item in the list example:   
           AddListItem(formDigest, appUrl, newTitle);

    error: function (err) {
        alert(xhr.status + ': ' + xhr.statusText);


Once the FormDigestValue is retrieved then we can save that in a variable and pass it in subsequent REST API Calls. A possible implemention of AddListItem could be as following:

function AddListItem(formDigestValue,appUrl, newTitle) { var jsonMetaData = { __metadata: { type: 'SP.Data.OAuthTestListListItem' }, Title: newTitle }; $.support.cors = true;

    url: appUrl,
    type: "POST",
    contentType: "application/json;odata=verbose",
    headers: { "accept": "application/json;odata=verbose", "x-requestdigest": formDigestValue, "If-Match": "*" },
    data: JSON.stringify(jsonMetaData),    

    xhrFields: { withCredentials: true },           
    success: function (data) {
        if (data.d) {               
            //do something here;
    error: function (xhr) {
        alert(xhr.status + ': ' + xhr.statusText);


Having said above please note that you have to add an out of box SharePoint page with a Script Editor or content query web part to perform CRUD. Doing in this way you dont need to have an app deployed to SharePoint and simply adding two webpart on a SharePoint Page along with code will do the trick.

Same code can be used from a stand alone website running under a common account, as long as you get a form digest successfully the code will work.

  • 1
    While this link may answer the question, it is better to include the essential parts of the answer here and provide the link for reference. Link-only answers can become invalid if the linked page changes. - From Review Commented Jan 24, 2017 at 4:01
  • Sorry guys I have just added. It was my first post on the sharepoint.stackexchange.com :(. Commented Jan 25, 2017 at 21:54
  • Hi Yogendra. I am having the same requirement where I have to fetch the SharePoint Data from external application running the same account. I have posted my question here sharepoint.stackexchange.com/questions/240402/… ...Please can you have a look on it and tell me where I am going wrong Commented Apr 20, 2018 at 14:10

Finally managed to get this working. I created a custom REST service by following this article http://www.codeproject.com/Articles/128478/Consuming-WCF-REST-Services-Using-jQuery-AJAX-Call and deployed the service to SP box as a new IIS website and then performed CRUD operation on SP Items by using CSOM.


This was the exact problem I was facing. This is an old question but my answer might be helpful to someone else coming here.

It is possible to do this. First you have do OAuth from standalone web-app. Here are the step by step instructions in my blog -


High Level overview -

1) Get client id and secret by registering yourself here - https://sellerdashboard.microsoft.com/Registration

2) Get Access Token, Refresh Token by following steps here -


Then make the rest api calls to perform CRUD operations on SharePoint data. https://msdn.microsoft.com/en-us/library/office/dn499819.aspx (Rest api reference) https://msdn.microsoft.com/en-us/library/office/jj164022.aspx (Rest api reference)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.