Web Service UpdateListItems User Permissions

Question

I'm trying to do an AJAX SOAP call to the Lists web service, specifically UpdateListItems. The query isn't malformed, and is working appropriately when using a user with full permissions. When a user with contribute permission tries the query below (and the list being written to is properly permission), I get a 403 error. Are UpdateListItems permissions set elsewhere, such as the web.config file?

UPDATE 1

I am using jQuery to make the AJAX call. Following is the code used:

       var query = '<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">\
        <soap:Body>\
            <UpdateListItems xmlns="http://schemas.microsoft.com/sharepoint/soap/">\
            <listName>{2C3F42BF-A33D-478A-A06E-2342FFC9F3F8}</listName>\
                <updates>\
                    <Batch OnError="Continue">\
                        <Method ID="1" Cmd="New">\
                            <Field Name="Title">email@email.com</Field>\
                            <Field Name="Name">My Name</Field>\
                            <Field Name="Date"></Field>\
                        </Method>\
                     </Batch>\
                </updates>\
                </UpdateListItems>\
            </soap:Body>\
        </soap:Envelope>';
        $.ajax
        ({
            url: "/_vti_bin/lists.asmx",
            beforeSend: function(xhr) { xhr.setRequestHeader("SOAPAction", "http://schemas.microsoft.com/sharepoint/soap/UpdateListItems"); },
            type: "POST",
            dataType: "xml",
            data: query,
            complete: processResult,
            contentType: "text/xml; charset=\"utf-8\""
        });

Answer 1

403 signifies that request was a legal, but the server is refusing to respond to it. Have you try setting ListVersion and ViewName attribute of Batch element, before sending the request?

For e.g.

<Batch OnError="Continue" ListVersion="1" 
ViewName="270C0508-A54F-4387-8AD0-49686D685EB2">
   <Method ID="1" Cmd="New">
      <Field Name='ID'>New</Field>
      <Field Name="Title">Value</Field>
      <Field Name="Date_Column">2007-3-25</Field>
      <Field Name="Date_Time_Column">
         2006-1-11T09:15:30Z</Field>
   </Method>
</Batch>

You can also dig into UpdateListItemsResponse to further refine the error code.

Answer 2

I seem to have found the solution. The user's permission level was missing the site permission Use Remote Interfaces. SharePoint defines it as

Use SOAP, Web DAV, or SharePoint Designer interfaces to access the Web site.

It makes perfect sense now that I look at it. I admittedly don't know enough about SharePoint permissions, and didn't know it was that fine-grained. I just assumed that if a user had write permissions for a list, they could write to it using any protocol.