I've been working for a while with SharePoint 2010 via REST API in my Java project.

For example, to list items under some directory in my SharePoint storage, I was doing like this:

NTCredentials credentials = new NTCredentials(username, password, null, domain);
HttpClient httpClient = //preparing HttpClient and providing created credentials to it;
HttpGet getMethod = //preparing GET method with setting appropriate Accept header and builded URL;,

where URL is built with appropriate API constants and filters, something like this:


Now I'm trying to make Office 365 SharePoint work in the way similar to it, but I don't succeed yet. (Most likely because I didn't catch some basic moments about the way it should work).

I can login into my Office 365 SharePoint via https://login.microsoftonline.com page.

When I try to make a request to my Office 365 SharePoint server in the same way as I do for a SharePoint 2010 server, I receive 403 Forbidden error.

I also have some clientId and redirect URL after registering my application to the Azure AD, but I don't understand how to use it properly.

So, what am I doing wrong and how to make all this stuff work properly?

2 Answers 2


Assuming you knew that you're authentication is working, then you might want to look into the new Rest endpoints of SharePoint online.

Here's a reference: https://msdn.microsoft.com/en-us/library/office/jj860569.aspx

The /_vti_bin/ListData.svc endpoint still exists but I think it's deprecated. The new rest endpoint follows the odata standards.

Give a call to http://mysharepointserver/_api/lists to see, if you get a result other than 403.

If you still get a 403 error. You might want to start looking at the samples here: http://dev.office.com/code-samples#?filters=java.

  • 1
    Thanks for answering, @MartijnE, but even if I use newer api, I still receive 403 Forbidden response from the server. I also figured out kinda solution described here: allthatjs.com/2012/03/28/… Using example provided in this article, I can get token which then I can pass as a cookie and make authentication works properly. Jul 27, 2016 at 12:31

You can use remote authentication like what is done in this page http://paulryan.com.au/2014/spo-remote-authentication-rest/. I have already tried this one and it works, you just need to follow the steps. You just need to get the security token in order to get the access token cookies. Cookies are necessary as a header when making requests and for getting the request digest which is also necessary when making "POST" requests.

  • Thanks for answering. As I mentioned in a comment to previous answer, this way is exactly what I did. However, I don't really like it. It looks kinda strange to make a couple of additional requests to get this token, while Microsoft's documentation keep talking me about Azure AD and registering my app and so on. I mean, I am wondering that this "registering" operation was useless after all. Jul 29, 2016 at 9:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.