Following code in app giving exception "Access denied. You do not have permission to perform this action or access this resource". Even I have allowed permission "APP > MANAGE PERMISSION > TRUST IT".

method: "GET",
url: hostweburl+"/_api/web/lists/getByTitle('Waqarreading')/items",
}).done(function(data) {
   console.log("list-data ==== ", data);
}).fail(function() {
   console.log("list-data Fail ");
}).always(function() {
                console.log( "list-data Completed!" );

Request sent at: https://waqarmuneer.sharepoint.com/_api/web/lists/getByTitle('Waqarreading')/items

  • i can't point you to a specific tutorial but this seems to be an issue related to cors. i hab the same problem recently and found that you need to enable cors in your web.config and add attributes to the controllers for the rest service to ensure that only requests from the right source actually can access the service.
    – garglblarg
    Sep 15, 2016 at 8:11
  • Hi @Waquar, I see you started another thread for issue you encountered using the cross domain library. If my answer to this topic was what you were looking for, could you kindly mark it as answer, please? Sep 15, 2016 at 9:48
  • @Cthulhubutt I already have tried cross domain library but i was getting no results. So still i am not sure about the solution you mentioned until i get the desired result. If you can help me get result I definitely happy to mark your answer.
    – Waqar
    Sep 15, 2016 at 9:58
  • @Waqar I would argue that since you are using executor in your second thread and not getting Access Denied error, your specific issue at that point did not occur. Now you are trying to work out why your cross domain library approach is not working. No worries though, give us a shout if you figure it out :) Sep 15, 2016 at 10:02

1 Answer 1


Last time I encountered such issue, I had to use cross-domain library as per following article:


as it states the following:

When a user requests a page from your add-in domain (1), the client-side communication is bound only to that domain. Your add-in can issue client-side calls from the page only to other resources in the same domain. However, add-ins usually require resources from other domains, such as the SharePoint domain, to fulfill their scenarios. In the code in your page, you may try to issue a request to the SharePoint domain (2), which is blocked by the browser. You usually see an Access is denied error. The error doesn’t imply that you don’t have permissions to the requested resources but, most likely, you can’t even issue a request to the mentioned resources.

  • convinced from your argue :) I hope you will follow me up for my next thread.
    – Waqar
    Sep 15, 2016 at 10:07
  • 1
    No worries, thanks, if the cross library solution does not work out for you, you can always un-mark this as answer, I have no problem with that :) Sep 15, 2016 at 10:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.