Access denied when uploading file using REST API

Question

I am using the Sharepoint Online REST API.

I can successfully make the following request:

GET /_api/web/GetFileByServerRelativeUrl('/Shared%20Documents/Hello.docx') HTTP/1.1
Host: SITE.sharepoint.com
Authorization: Bearer TOKEN
Accept: application/atom+xml
Cache-Control: no-cache

However, when I try to make the below request

POST /_api/web/GetFolderByServerRelativeUrl('/Shared Documents')/files/add(overwrite=true,url='test.txt') HTTP/1.1
Host: SITE.sharepoint.com
Authorization: Bearer TOKEN
Accept: application/atom+xml
Cache-Control: no-cache

"hello, world"

I get the response

<?xml version="1.0" encoding="utf-8"?>
<m:error xmlns:m="http://schemas.microsoft.com/ado/2007/08/dataservices/metadata">
    <m:code>-2147024891, System.UnauthorizedAccessException</m:code>
    <m:message xml:lang="en-US">Access denied. You do not have permission to perform this action or access this resource.</m:message>
</m:error>

I am requesting the following scopes:

Web.FullControl Site.FullControl AllSites.FullControl List.FullControl

Am I missing a scope for this request, or is there some other permissions I need to set elsewhere?

Answer 1

Figured it out!

According to Authentication Code OAuth flow for SharePoint Add-ins:

the FullControl right is not available ... because an add-in that request permission to access SharePoint resources on the fly can't request full control right

So setting the requested scope to be Web.Manage allowed me to upload the file as needed.

Answer 2

Are you including the the form digest? This is necessary when doing a POST.

To get the form digest in postman first do a POST request with this URL:

http://yoursite/_api/contextinfo

You'll get a long string back which you then need to add to the POST request you're trying to make as a Header in the X-RequestDigest parameter.

Full details here.