Getting 403 while using SharePoint REST API

Question

I'm developing an add-in part (app part) for SharePoint in which I would like to do some CRUD operations. I've already added FullControl permission to SiteCollection in the manifest.

So far I've been able to successfully read list data using oData but I'm getting 403 (Access denied. You do not have permission to perform this action or access this resource.) while trying to post any changes.

Also, I'm getting the same response code when trying to get current user info by using:

$(document).ready(function () {
    var search = query.parse()

    $.ajax({
        url: search.SPAppWebUrl + '/_api/contextinfo',
        method: 'POST',
        headers: { 'Accept': 'application/json; odata=verbose' }
    }).done(function (data) {
        var requestDigest = data.d.GetContextWebInformation.FormDigestValue
        $.ajax({
            url: search.SPHostUrl + "/_api/SP.UserProfiles.PeopleManager/GetMyProperties?$select=PictureUrl,DisplayName,Email",
            method: "GET",
            headers: {
                'Accept': 'application/json; odata=verbose'
            },
            complete: function () {
                console.log(arguments)
            }
        })
    })
})

Is it even possible to it from inside app web? Am I missing something?

Answer 1

Forbidden Error Generally occurs because of these two reasons

• Your Form Digest value is not correct.
• The user you are running tests as doesn't have the requisite permissions.

In the Header section include

  "X-RequestDigest": $("#_REQUESTDIGEST").val()

check this sharepoint stackexchange link

Answer 2

The "403" error you will receive because of lack permissions. As you mentioned you are doing all these operations in a SharePoint App. So you have to verify APP permissions. The below article explains permission policies and level. In general SharePoint Add-in runs with App permissions.

https://msdn.microsoft.com/library/fp179892(office.15).aspx

https://msdn.microsoft.com/en-us/library/fp142383.aspx

Check your Request Digest value as well from page hidden variable

$("#_REQUESTDIGEST").val()

Answer 3

Not sure if this post is still active but in order to get a value for the digest number you need to have a double underscore:

"X-RequestDigest": $("#__REQUESTDIGEST").val()

Also this will not work unless your code is being executed with the domain of a sharepoint page (.aspx). Trying to run the code from a standard html page wont have the correct associated sharepoint libraries. Hope this helps.