I am attempting to create a REST call across domains (we have different farms with different domains in our organization. I am not doing this through an app, but instead I am doing it via a CEWP loading my javascript files on a site page. All I am attempting to do is get the data from a list item. I am attempting this with an AJAX call that has the properties: withCredentials= true and crossDomain: true. When I watch the flow in Fiddler, the call is returning a 200 that contains the data in JSON, but before each 200 I get a 401 and I believe this is what my function is getting back. Eventually getting the 200 doesn't do me any good because the 401 is going back to the function call (I think).

Here's my code:

function getListItemByIDAjax(siteURL, listName, itemID, complete, failure) {
    url: siteURL + "/_api/web/lists/getbytitle('" + listName + "')/items(" + itemID + ")",
    method: 'GET',
    xhrFields: {
        withCredentials: true
    beforeSend: function(XMLHttpRequest){
        XMLHttpRequest.setRequestHeader("Accept", "application/json; odata=verbose");
    cache: true,
    success: function (data) {
            // Returning the results
    error: function (data) {
            // Returning the results

I can't be the first person trying to accomplish this, but I sure am not finding any information out there that seems to work in this instance. Any help would be greatly appreciated.

  • Were you able to address this? I'm having an identical issue
    – Oxossi
    Commented Apr 19, 2018 at 17:00

2 Answers 2


In Windows Authentication (NTLM), getting two 401 before one 200 is completely expected: this is the way challenge/response works. You usually don't notice it with same-domain calls since you're already authenticated with a session cookie.

  • Ok, so is my function call grabbing the response from the 401? If so, is there a way to get the 200 data? Commented Jan 15, 2016 at 17:54
  • Are you unable to tell if your error or completion handlers are being triggered? Can you add simple logging to test? The fact that the data is coming back on the 200 should mean your call is working fine.
    – Sean
    Commented Jan 18, 2016 at 20:03

In SharePoint to make cross domain calls, you need to create request using SP.RequestExceutor.JS

see the below MSDN links


Access Data from Cross Domain

  • The RequestExecutor is specifically for Apps and calling from the appweb to the host web, or to other site collections from the app within the same tenant - the question is regarding code not called from an app, and to a totally separate SharePoint farm. I think this is worth a try, but I do not believe it will work, nor is it the recommended approach for this scenario.
    – Sean
    Commented Jan 18, 2016 at 20:01
  • I agree, this is not meant to work in this case. I also didn't expect it to work, but in order to be sure I did infact run it. Failed as expected. Commented Jan 18, 2016 at 20:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.