I'm developing an add-in part (app part) for SharePoint in which I would like to do some CRUD operations. I've already added FullControl permission to SiteCollection in the manifest.

So far I've been able to successfully read list data using oData but I'm getting 403 (Access denied. You do not have permission to perform this action or access this resource.) while trying to post any changes.

Also, I'm getting the same response code when trying to get current user info by using:

$(document).ready(function () {
    var search = query.parse()

        url: search.SPAppWebUrl + '/_api/contextinfo',
        method: 'POST',
        headers: { 'Accept': 'application/json; odata=verbose' }
    }).done(function (data) {
        var requestDigest = data.d.GetContextWebInformation.FormDigestValue
            url: search.SPHostUrl + "/_api/SP.UserProfiles.PeopleManager/GetMyProperties?$select=PictureUrl,DisplayName,Email",
            method: "GET",
            headers: {
                'Accept': 'application/json; odata=verbose'
            complete: function () {

Is it even possible to it from inside app web? Am I missing something?

3 Answers 3


Forbidden Error Generally occurs because of these two reasons

  • Your Form Digest value is not correct.
  • The user you are running tests as doesn't have the requisite permissions.

In the Header section include

  "X-RequestDigest": $("#_REQUESTDIGEST").val()

check this sharepoint stackexchange link

  • Unfortunately both: 'X-RequestDigest': $("#_REQUESTDIGEST").val() and 'X-RequestDigest': data.d.GetContextWebInformation.FormDigestValue didn't work. Also, my user is a primary administrator of this site collection so I think he should have full permissions. Commented May 4, 2017 at 13:12

The "403" error you will receive because of lack permissions. As you mentioned you are doing all these operations in a SharePoint App. So you have to verify APP permissions. The below article explains permission policies and level. In general SharePoint Add-in runs with App permissions.



Check your Request Digest value as well from page hidden variable



Not sure if this post is still active but in order to get a value for the digest number you need to have a double underscore:

"X-RequestDigest": $("#__REQUESTDIGEST").val()

Also this will not work unless your code is being executed with the domain of a sharepoint page (.aspx). Trying to run the code from a standard html page wont have the correct associated sharepoint libraries. Hope this helps.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.