I'm trying to use a 2013 designer workflow to read a cross-site collection list. I'm following several different tutorials similar to this one.

Because of the cross-site stuff I'm first doing a POST to

https://<remote site>/_api/contextinfo

The trick to get that to work was to include Authorization with no value in the request headers. And eventually I got that to work. And I'm retrieving the d/GetContextWebInformation/FormDigest value. I log it to the work history list and it looks correct. My understanding is that the digest is what is required to allow reading of the remote list.

I then create a new requestHeaders dictionary with the following values.

X-RequestDigest:variable digestValue

And then I try and make a GET request to

https://<remote site>/_api/web/lists/getbytitle('<listname>')/items

I'm getting a response code of unauthorized and the following response content:

{"error":{"code":"-2147024891, System.UnauthorizedAccessException","message":{"lang":"en-US","value":"Access denied. You do not have permission to perform this action or access this resource."}}}

Both sites are on the same farm and I'm site collection owner of both sites and have full control in both locations.

I've tried adding the Authorization blank to the request headers. I've tried changing the capitalization (just in case you were going to suggest that) of all the different params in the request headers. I've checked the url and list name and it is correct.

Any ideas on how to get this to work?

A little bit more I couldn't log the returned contents nor request header dictionary to the work history -- they would crash the workflow. But I can email them to myself, so here they are.

This is the response to contextinfo endpoint. It looks correct to me.

         "FormDigestValue":"0x01E2FB49D36AAFC7DE415ECD0FB7542817ECCB7F01E27D06E2563C5DC3EBBD524A4116E3139C5E59D39FE81148B4C5287574263F903A15BE7A8C4A3505E3FF94,20 Jun 2017 19:58:30 -0000",

And this is the request headers I constructed with the returned value.

   "X-RequestDigest":"0x01E2FB49D36AAFC7DE415ECD0FB7542817ECCB7F01E27D06E2563C5DC3EBBD524A4116E3139C5E59D39FE81148B4C5287574263F903A15BE7A8C4A3505E3FF94,20 Jun 2017 19:58:30 -0000"

Overall they look correct to me. Anybody else?

  • Thank you for the post. I did all you've said, but still getting the below error while sending mails from workflow. Even I've added an App Step, but no success. Details: System.ApplicationException: HTTP 500 {"Transfer-Encoding":["chunked"],"X-SharePointHealthScore" any help on this? thank you ananda Sep 8, 2017 at 5:34
  • If you have a new question, please ask it by clicking the Ask Question button. Include a link to this question if it helps provide context. - From Review
    – Gaurravs
    Sep 8, 2017 at 6:47
  • This does not really answer the question. If you have a different question, you can ask it by clicking Ask Question. You can also add a bounty to draw more attention to this question once you have enough reputation. - From Review
    – Asad Refai
    Sep 8, 2017 at 9:15

1 Answer 1


You can try to run the workflow with elevated privileges. In SharePoint 2013 designer workflow to run with elevated privileges, you should run your HTTP web call action in the APP Steps.

The steps you have to follow to activate the APP Step

  • Go to Site Settings.
  • Go to "Manage Site Features"
  • Activate the feature "Workflow can use App Permissions".

This will APP Step in the SharePoint Designer workflow ribbon.

By default, the app step will have permissions to do any change in the current site. To give additional permissions to the Workflow app we need to follow below steps.

App permissions to workflow steps

  • Go to site settings.
  • In the Users and Permissions section, select Site app permissions.
  • Copy the client section of the App Identifier. This is the identifier between the last "|" and the "@" sign.
  • Navigate to the Grant permission to an app page.
  • Add new permissions from the http://{hostname}/{the Site Collection}/_layouts/15/appinv.aspx page.
  • You have to paste the Workflow App Id to that page.
  • Paste the following permissions to permissions textbox.
    <AppPermissionRequest Scope="http://sharepoint/content/sitecollection" Right="Read" />
    <AppPermissionRequest Scope="http://sharepoint/content/sitecollection/web" Right="FullControl" />

The above one read every resource from site collection and has full control on current web resources.

The APP permissions may differ as per your requirement.

You can refer below article for complete steps

Configure SPD workflow to run with elevated privileges

Different APP permissions to set for workflow

  • I'm a little confused as to which site collection I do this on? My workflow is running on Site A and trying to REST query Site B. I activate "Workflow can use App Permissions" for Site A and then I go to Site B/_layouts/15/appinv.aspx (That is the Grant permissions to an app page, right?) and do the steps you layout out. Is that right? Also is there a way to that page from the UI?
    – Rothrock
    Jun 21, 2017 at 15:09
  • You have to go to the Site A workflow where your workflow is running Jun 21, 2017 at 15:10
  • You have to go to http://siteA/_layouts/15/appinv.aspx and set the app permissions. Jun 21, 2017 at 15:25
  • Then how does site B know that it should trust the workflow from site A?
    – Rothrock
    Jun 21, 2017 at 15:56
  • Think it like this. If an App wants to access information from a site collection or a farm we are setting an app required permissions. In the same way, you are telling Site A workflow we are giving rights to access the information in site collection. Jun 21, 2017 at 16:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.