I am not sure how to get Request Digest token value from /_api/contextinfo this end point. I need this so I can extract value for uploading file to folder on Sharepoint site.

I am making post request:

            String uri = site + "/_api/web/contextinfo";               
            HttpPost httppost = new HttpPost(uri);              
            httppost.addHeader("Accept", "application/json;odata=verbose");
            httppost.addHeader("Content-Type", "application/json;odata=verbose");
            httppost.addHeader("X-FORMS_BASED_AUTH_ACCEPTED", "f");

but I was getting 403 response. That meant to me that I need to authorize request.

I tried adding credentials to request but for that I was getting 401 response.

I tried adding cookie SPOIDCRL, but was getting 401 also.

I don't know how to authorize to SPO to get this digest code. I am using admin user with site that that user made.

This is response:

HttpResponseProxy{HTTP/1.1 401 Unauthorized [Content-Length: 16, Content-Type: text/plain; charset=utf-8, P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI", WWW-Authenticate: NTLM, SPRequestGuid: 3b0b209e-3057-4000-89dc-22ee8fdc666e, request-id: 3b0b209e-3057-4000-89dc-22ee8fdc666e, MS-CV: niALO1cwAECJ3CLuj9xmbg.0, Strict-Transport-Security: max-age=31536000, X-FRAME-OPTIONS: SAMEORIGIN, SPRequestDuration: 77, SPIisLatency: 2, X-Powered-By: ASP.NET, MicrosoftSharePointTeamServices:, X-Content-Type-Options: nosniff, X-MS-InvokeApp: 1; RequireReadOnly, X-MSEdge-Ref: Ref A: 4F5CBF8A183748B3923EB639D7BCC861 Ref B: VIEEDGE0810 Ref C: 2017-10-05T21:52:49Z, Date: Thu, 05 Oct 2017 21:52:49 GMT] ResponseEntityProxy{[Content-Type: text/plain; charset=utf-8,Content-Length: 16,Chunked: false]}}
  • Use Oauth and all issues will go away.
    – mikipero
    Oct 20, 2017 at 7:22
  • Please add more details to be a helpful answer! Oct 20, 2017 at 13:15
  • This does not provide an answer to the question. To critique or request clarification from an author, leave a comment below their post. - From Review Oct 20, 2017 at 15:05

2 Answers 2

  1. Register an app (Like in here : http://www.ktskumar.com/2017/01/access-sharepoint-online-using-postman/)

  2. Make GET request to URL: xxx.sharepoint.com/_vti_bin/client.svc/ Header("Authorization", "Bearer");

Expected response 401. Read 2 parameters: (Bearer) realm and client_id.

  1. Make POST request

    String uri = "https://accounts.accesscontrol.windows.net/" + realm + "/tokens/OAuth/2"; Add these parameters to body: params.add(new BasicNameValuePair("grant_type", "client_credentials")); params.add(new BasicNameValuePair("client_id", USER_NAME + "@" + realm)); params.add(new BasicNameValuePair("client_secret", PASSWORD)); params.add(new BasicNameValuePair("resource", client_id + "/xxx.sharepoint.com@" + realm));

Expected response 200. Read 1 parameter: access_token

  1. get FormDigestValue: make POST request to

    URL: xxx.sharepoint.com/_api/contextinfo httppost.setHeader("Authorization", "Bearer " + access_token); httppost.addHeader("Accept", "application/json;odata=verbose");

Expected response 200. Read 1 parameter: xDigestRequest (FormDigestValue) (figure this out)

  1. Save file: Make POST

    URL = "xxx.sharepoint.com/_api/web/GetFolderByServerRelativeUrl(\'" + folderName + "\')/Files/add(url=\'" + fileName + "\',overwrite=true)";

    byte[] array = Files.readAllBytes(file.toPath());

    HttpPost httppost = new HttpPost(uri); httppost.setHeader("Authorization", "Bearer " + token); httppost.setHeader("X-RequestDigest", xDigestRequest); httppost.addHeader("Accept", "application/json;odata=verbose"); httppost.addHeader("binaryStringRequestBody", "true"); //???? maybe not needed

Expected 200 and that is it.

I hope this helps someone


Here you go.

Remotely access SharePoint Online documents

Build the xml to request _layouts/15/Authenticate.aspx

<s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" 
    <a:Action s:mustUnderstand="1">http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue</a:Action> 
    <a:To s:mustUnderstand="1">https://login.microsoftonline.com/extSTS.srf</a:To> 
    <o:Security s:mustUnderstand="1" 
    <t:RequestSecurityToken xmlns:t="http://schemas.xmlsoap.org/ws/2005/02/trust"> 
      <wsp:AppliesTo xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy"> 

While, it’s recommended to use CSOM to access SharePoint online data.

  • My question was to upload document to SPO, not to download! Actually, to authorize when getting code
    – mikipero
    Oct 6, 2017 at 8:23
  • The sample just show you how to get request digest so you could use the digest to upload the file.
    – Lee
    Oct 6, 2017 at 8:28
  • docs.microsoft.com/en-us/sharepoint/dev/sp-add-ins/… says that: Another important consideration when creating, updating, and deleting SharePoint entities is that if you aren't using OAuth to authorize your requests, these operations require the server's request form digest value as the value of the X-RequestDigest header. You can retrieve this value by making a POST request with an empty body to http://<site url>/_api/contextinfo and extracting the value of the d:FormDigestValue node in the XML that the contextinfo endpoint.
    – mikipero
    Oct 6, 2017 at 8:40
  • I think the solution woks when user has logged in, while for your requirements, the user should not log in yet.
    – Lee
    Oct 6, 2017 at 10:14
  • Yes, problem is how to authorize.
    – mikipero
    Oct 11, 2017 at 9:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.