I followed this tutorial Create a Sharepoint List using Rest Api but I had a

message error : "Failed to load resource: the server responded with a status of 403 (Forbidden)"

when I have clicked on the bottom "Create your custom list"


Make sure to check(highlighted below) the Allow the add-in to make app-only calls to SharePoint before you deploy the add-in to SharePoint

enter image description here


  • thanks you M.Qassas for your consideration, but that doesn't work. (Already something I don't understand in the tutorial. He says to use Napa, so I don't find those permissions with Napa.) After I have created the add-ins with visual studio in applying your councils but that don't work (always the same error : 403 (forbidden) ), the checkbox must be uncheck like your pictures, and under I must choose "Web" and "Full-Control" ?
    – Mathi
    Aug 8 '16 at 23:37
  • How do you get to these settings? What is the navigation route?
    – bgmCoder
    Aug 9 '16 at 3:18
  • Ah - okay, it is in Visual Studio's app manifest.
    – bgmCoder
    Aug 9 '16 at 3:24
  • @M.Qassas - I've seen Mathi's code - he's applied that setting, but he's still getting Forbidden when the addin tries to access the list.
    – bgmCoder
    Aug 9 '16 at 3:51

Forbidden error generally occurs because of these two reason-

  1. Your Form Digest value is not correct.
  2. The user you are running tests as doesn't have the requisite permissions.

To solve 1 - use $('#__REQUESTDIGEST').val() to get the form digest value.

This code may be helpful for you:

        url: _spPageContextInfo.webAbsoluteUrl + "/_api/web/lists",
        type: "POST",
        data: JSON.stringify({
            '__metadata': { 'type': 'SP.List' }, 'AllowContentTypes': true, 'BaseTemplate': 100,
            'ContentTypesEnabled': true, 'Description': 'My list description', 'Title': 'Employees'
        headers: {
            "accept": "application/json;odata=verbose",
            "content-type": "application/json;odata=verbose",
            "X-RequestDigest": $("#__REQUESTDIGEST").val()
        success: onSuccess,
        error: onError
    function onSuccess(data) {
        alert(data + ' List Created');
    function onError(error) {

To solve case 2 - you have to give the requisite permission. For more Click Here

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.