3

I'm making progress in learning to use the rest API (HTTP web service) in SPD.

WF1: Acivates to a change to a list. WF1 is suppose to launch WF2 using the Rest API. Within WF1 I have the WF2 GUID and the list ID where the change occured.

WF2: At the moment, just logs to workflow history.

[web site]_api/SP.WorkflowServices.WorkflowInstanceService.Current/StartWorkflowOnListItemBySubscriptionId(subscriptionId=’[WF2_GUID]’,itemId=’[ItemID]’)

The request header:

Accept : application/json;odata=verbose
Content-Type : application/json;odata=verbose

The response code = OK, but the WF is not launching. Does the X-RequestDigest need to be populated for the POST to work?

Note - I'm not doing any coding. Trying to keep this OOTB.

Kind regards,

1
  • Thanks for the help people. At least now I get HTTP/1.1 403 Forbidden rather than HTTP/1.1 400 Bad Request. Moving on..... – MaxK-2773298 Nov 10 '16 at 23:01
5

Think of the RequestDigest as a key that opens the cabinet.

  • You can GET information without opening it.

  • There is information you cannot GET without opening it.

  • You need the key to PUT (POST) information in

3
  • 1
    Danny I'm already passing in an Oauth token as an Authorization header, yet I still need RequestDigest? (testing using Postman). What value then should RequestDigest be? The same as Authorization token? I tried that and still get System.Collections.Generic.KeyNotFoundException — The given key was not present in the dictionary. – Growler Apr 2 '18 at 22:56
  • [I have left the SP world, yeah!] You need to call the contextinfo endpoint and get the value: sharepoint.stackexchange.com/search?q=requestdigest+contextinfo – Danny '365CSI' Engelman Apr 4 '18 at 7:57
  • @Growler I agree .Since you're already using OAuth this shouldn't be necessary. MS Docs say this: "If you're using the authentication and authorization flow described in Authorization and authentication of SharePoint Add-ins, you don't need to include the request digest in your requests." – Steven Sep 22 '20 at 3:34
3

Yes. You do need it for anything other than "GET". And it doesn't hurt with that, so I recommend using it for all requests.

See this documentation about halfway down the page...

The way you get and send the form digest value depends on the add-in When you send a POST request, the request must include the form digest value in the X-RequestDigest header. However, the way you get and send the value differs by add-in:

It then goes on to say how you do that with different environments.

3

Yes it is required for POST, below are snapshot from MSDN.

Another important consideration when creating, updating, and deleting SharePoint entities is that if you aren’t using OAuth to authorize your requests, these operations require the server’s request form digest value as the value of the X-RequestDigest header. You can retrieve this value by making a POST request with an empty body to http:///_api/contextinfo and extracting the value of the d:FormDigestValue node in the XML that the contextinfo endpoint returns. The following example shows an HTTP request to the contextinfo endpoint in C#.

Reference link

1

Since OP has mentioned in responses that they are using an OAuth token, then the answer is no, you don't need to use X-RequestDigest.

The documentation on this is explicit:

Another important consideration when creating, updating, and deleting SharePoint entities is that if you aren't using OAuth to authorize your requests, these operations require the server's request form digest value as the value of the X-RequestDigest header.

followed by

If you're using the authentication and authorization flow described in Authorization and authentication of SharePoint Add-ins, you don't need to include the request digest in your requests.

I successfully use OAuth for my requests and do not need to specify it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.