REST MERGE ListItem forbidden (403) SharePoint Online

Question

In SharePoint Online I need to Update item in Workflow Task List using REST API on same server.

I am receiving 403 forbidden error, but I am on the same error and unable to identify why should I am receiving this error.

 $.ajax({
      url: "https://mysite.sharepoint.com/it/_api/web/lists/GetByTitle('Workflow%20Tasks')/items?$filter=(Title%20eq%20%27Employee%20Application%20Request%20No:%20621%27)",
         type: "POST",
         data: JSON.stringify({ '__metadata': { 'type': 'SP.Data.WorkflowTasksItem' } }),
         headers: { 
             "X-HTTP-Method":"MERGE",
             "accept": "application/json;odata=verbose",
             "content-type": "application/x-www-url-encoded",
             //"content-length": 1000,
             "X-RequestDigest": $("#__REQUESTDIGEST").val(),
             "IF-MATCH": "*"
         },
         success: function (data) {
             // Returning the results
             console.log(data);
         },
         error: function (data) {
             console.log(data);
         }
  });

And its giving below error: jquery-1.4.4.min.js:141 POST https://mysite.sharepoint.com/../ 403 (Forbidden)

Answer 1

It's not possible to find and update items in REST API. You can update a single item at a time. So your End-Point should look like.

/_api/web/lists/getbytitle('{list name here}')/items({item id here})

OR

/_api/web/lists/getbytitle('{list name here}')/items/getbyid({item id here})

Find some useful information here.

Example

function updateItem(url, oldItem, newItem) {
    $.ajax({
        url: _spPageContextInfo.webAbsoluteUrl + url,
        type: "PATCH",
        headers: {
            "accept": "application/json;odata=verbose",
            "X-RequestDigest": $("#__REQUESTDIGEST").val(),
            "content-Type": "application/json;odata=verbose",
            "X-Http-Method": "PATCH",
            "If-Match": "*"
        },
        data: JSON.stringify(newItem),
        success: function (data) {
            console.log(data);
        },
        error: function (error) {
            alert(JSON.stringify(error));
        }
    });
}

Answer 2

You are not sending data in the URL

What happens with:

"contentType": "application/json;odata=verbose",

Answer 3

In my case I found if we provide wrong details in meta data it will provide us 403 forbidden error.

So I change List name return by get Items query

data: JSON.stringify({ '__metadata': { 'type': 'SP.Data.Workflow_x0020_Tasks1ListItem' }, 'Status':'Completed', 'PercentComplete':'100','Nintex_x0020_Task_x0020_Outcomes':'Approved' }),

Also found that we need to get the result using GetById instead of GetByTitle