I followed this tutorial Create a Sharepoint List using Rest Api but I had a

message error : "Failed to load resource: the server responded with a status of 403 (Forbidden)"

when I have clicked on the bottom "Create your custom list"

2 Answers 2


Make sure to check(highlighted below) the Allow the add-in to make app-only calls to SharePoint before you deploy the add-in to SharePoint

enter image description here


  • thanks you M.Qassas for your consideration, but that doesn't work. (Already something I don't understand in the tutorial. He says to use Napa, so I don't find those permissions with Napa.) After I have created the add-ins with visual studio in applying your councils but that don't work (always the same error : 403 (forbidden) ), the checkbox must be uncheck like your pictures, and under I must choose "Web" and "Full-Control" ?
    – Mathi
    Aug 8, 2016 at 23:37
  • How do you get to these settings? What is the navigation route?
    – bgmCoder
    Aug 9, 2016 at 3:18
  • Ah - okay, it is in Visual Studio's app manifest.
    – bgmCoder
    Aug 9, 2016 at 3:24
  • @M.Qassas - I've seen Mathi's code - he's applied that setting, but he's still getting Forbidden when the addin tries to access the list.
    – bgmCoder
    Aug 9, 2016 at 3:51

Forbidden error generally occurs because of these two reason-

  1. Your Form Digest value is not correct.
  2. The user you are running tests as doesn't have the requisite permissions.

To solve 1 - use $('#__REQUESTDIGEST').val() to get the form digest value.

This code may be helpful for you:

        url: _spPageContextInfo.webAbsoluteUrl + "/_api/web/lists",
        type: "POST",
        data: JSON.stringify({
            '__metadata': { 'type': 'SP.List' }, 'AllowContentTypes': true, 'BaseTemplate': 100,
            'ContentTypesEnabled': true, 'Description': 'My list description', 'Title': 'Employees'
        headers: {
            "accept": "application/json;odata=verbose",
            "content-type": "application/json;odata=verbose",
            "X-RequestDigest": $("#__REQUESTDIGEST").val()
        success: onSuccess,
        error: onError
    function onSuccess(data) {
        alert(data + ' List Created');
    function onError(error) {

To solve case 2 - you have to give the requisite permission. For more Click Here

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.