I am trying to update a field in a list item via REST. I'm using the same passing of security info with the XML-RequestDigest header that works for adding items.

Here is my REST call (via javascript while logged in with plenty of credentials):

"url":"https://mysite/_api/web/lists/GetByTitle('My list')/items(110976)",
"XML-RequestDigest":"0xFE772DD886DA20FD369A60C93CCEE7DB719DB7AE8C08CBE3F1702BFA9F248665DFA1553B73795D1CA0D015FE072D22E87E8AA329203D9CCE575C5E69A6A149F0,08 Apr 2016 20:16:08 -0000",
"data":"{\"Primary\":\"2 - Marino\"}"

It returns: (403) Forbidden

        "code":"-2130575251, Microsoft.SharePoint.SPException",
            "value":"The security validation for this page is invalid and might be corrupted. Please use your web browser's Back button to try your operation again."

What am I doing wrong?

Not sure if related:

  • The call is made in a callback handler of a previous REST call. (However, the XML-RequestDigest is computed immediately before the call with $("#__REQUESTDIGEST").val().) Do the security credentials not play nice with chained asynchronous calls?
  • This is my first attempt at a REST update, and I am assuming that I should only send the field being altered, and that the Url handles the matching of the request to the original object. Valid assumptions? I've tried adding ID to the data, but it did not help. Do I need to add other fields?
  • If there is anything required to check-out the item before updating it, I haven't done it, since I'm not aware of any such mechanism.
  • The call is being made from a display page, rather than an edit page. Could SharePoint possibly block edits from display pages?
  • I've also attempted to get a fresh RequestDigest value with the method shown here with a post request. This gave an identical error to when I used the value provided by the page.
    – SvdSinner
    Commented Apr 11, 2016 at 15:16

3 Answers 3


Change your header attribute "XML-RequestDigest" to "X-RequestDigest".

Reference: https://docs.microsoft.com/pt-br/sharepoint/dev/sp-add-ins/working-with-lists-and-list-items-with-rest#working-with-lists-by-using-rest


Make this call before issuing your update to ensure you have a current form digest.

UpdateFormDigest(_spPageContextInfo.webServerRelativeUrl, _spFormDigestRefreshInterval)

See SharePoint 2013: How to refresh the Request Digest value in JavaScript for more information.

SharePoint 2013 (and previous versions) uses a client side “token” to validate posts back to SharePoint to prevent attacks where the user might be tricked into posting data back to the server. This token is known by many names; form digest or message digest or request digest. The token is unique to a user and a site and is only valid for a (configurable) limited time.

When building Apps or customizations on top of SharePoint, especially using patterns such as Single Page Applications (SPA) or using frameworks such as knockout.js it is very common that you see errors due to that the token is invalidated, which is due to that you have not reloaded the page and the token has timed out. The purpose of this article is to show you how you can refresh this form digest using JavaScript.

  • As I mentioned in the comment above, I've tried the methods in that post and they did not resolve the issue. Could there be a server-side setting/issue that I need the admins to look into?
    – SvdSinner
    Commented Apr 15, 2016 at 14:56

It looked like the data was structured wrong, I've broken it out into it's own variable so you can see the general look of how it should be.

In itemdata, the type has to be specific to the list it is going into SP.Data.<ListName>ListItem. It is also a good idea to get the request digest at the time of execution.

You can try something like this:

var itemdata = @"{
    __metadata: {type: 'SP.Data.MylistListItem' },
    Primary: '2 - Marino'

    url: _spPageContextInfo.webAbsoluteUrl + '/_api/web/lists/getByTitle('My List').items(110976)',
    type: 'POST',
    headers: {
        'accept': 'application/json;odata=verbose',
        'X-RequestDigest': $('#__REQUESTDIGEST').val(),
        'content-Type': 'application/json;odata=verbose',
        'IF-MATCH': '*',
        'X-HTTP-Method': 'MERGE'
    data: itemdata,
    success: function(data){
        <do something with data>
    error: function(data){

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.