Is it possible to write to a list on another site from NAPA developed App on o365 SharePoint Online.

I have a simple app that can write to lists on the host web by fully qualifying the list, but i get a forbidden error if I try on a list another site. I've shared my NAPA app here: Shared NAPA App Code Link

and here is my code:

    $.getScript(scriptbase + "SP.RequestExecutor.js");
var context = SP.ClientContext.get_current(); 
// Utilities
// Retrieve a query string value.
// For production purposes you may want to use a library to handle the query string.
function getQueryStringParameter(paramToRetrieve) {
    var params = document.URL.split("?")[1].split("&");
    for (var i = 0; i < params.length; i = i + 1) {
    var singleParam = params[i].split("=");
    if (singleParam[0] == paramToRetrieve) return singleParam[1];
function getListItemType(name) {
    // because for CustomerEquipment underscore creates a problem,
    // has to be'SP.Data.Customer_x005f_EquipmentListItem'
    name = name.replace('_', '_x005f_');
    // eliminate spaces, dashes
    name = name.replace(/[- '"]/gm, '');

    return "SP.Data." + name[0].toUpperCase() + name.substring(1) + "ListItem";
 function prepareJSONData(id, fieldName, fieldValue) {
        var listItemType = getListItemType("test5");
        var obj = {};
        obj['__metadata'] = { 'type': listItemType };
        obj['ID'] = id;
        obj[fieldName] = fieldValue;

        return JSON.stringify(obj);
function EditListItems()
  var id = 1;//$("#txtId").val();
 var name = $("#UpdateFieldValue").val();
 var ur = appweburl.split('https://')[1];
ur =  "https://"+ur.split('/')[0];

        url: ur+"/sites/<sitenamehere>/_api/web/lists/getbytitle('test5')/items(" + id + ")",    //data.__metadata.uri    
       data: prepareJSONData("1", "phone", name),    //JSON.stringify(itemProperties),
                    type: "POST",        
        headers: {
                   "ACCEPT": "application/json;odata=verbose",
                   "content-type": "application/json;odata=verbose",
                   "X-RequestDigest": $("#__REQUESTDIGEST").val(),
                   "IF-MATCH": "*", //data.__metadata.etag
                   "X-HTTP-Method": "MERGE"
        success: function (data) {
            alert("Updated successfuly");
        error: function (error) {



  • Is the Addin deployed in the root and are you trying to access a child site? I never tried it, but can imagine an Addin is not allowed access outside its scope, even if you have set SiteCollection access. Commented Aug 30, 2015 at 13:27
  • I'm not sure what the Addin is.. Trying to write to a site collection that is not the root site or a sub site of the host root. Appears I have it working now, but some questions remain about who can trust the app and how to move the app between sites without having to redeploy with NAPA.
    – Hell.Bent
    Commented Aug 30, 2015 at 18:32

1 Answer 1


I got a similar issue when I tried to upload a document to One Drive using a SharePoint Hosted app, I used REST to upload document, I got Forbidden error even if my App has full permissions to tenant. I used a Developer site to implement the app. Later I came to know that we cannot do cross site operations with an app deployed at a site collection level with development feature enabled. So I gave tenant level permissions to my app, and deployed it to app catalog, from there; I used deployment option to deploy it to my site. It started working without any code change.

Here is the link describes the app catalog feature.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.