Getting 403: Forbidden on Sharepoint Online when trying to use getContent - SiteData.asmx

Question

On SharePoint Online, I'm trying to query the SiteData.aspx web service to get all the content in a SharePoint site:

Endpoint: https://mytenant.sharepoint.com/sites/MySite/_vti_bin/SiteData.asmx

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:soap="http://schemas.microsoft.com/sharepoint/soap/">
   <soapenv:Header/>
   <soapenv:Body>
      <soap:GetContent>
         <soap:objectType>Site</soap:objectType>
         <soap:retrieveChildItems>true</soap:retrieveChildItems>
         <soap:securityOnly>true</soap:securityOnly>
      </soap:GetContent>
   </soapenv:Body>
</soapenv:Envelope>

I have rtfa and fedauth cookies present on the request, yet every time I get a response of: 403: Forbidden

My admins say I have been given the following permissions to this site:

• View Items
• Open Items
• View Versions
• View Application Pages
• Site Permissions
• View Web Analytics Data
• Browse Directories
• View Pages
• Enumerate Permissions
• Browse User Information
• Use Remote Interfaces
• Open
• Edit Personal User Information

Why am I still getting 403 errors here? Is there some other permission I need to be granted?

Answer 1

I would recommend looking at changing to REST. The ASMX service was deprecated after SP2010 and is only still around for backwards compatibility. Deprecated Services

But, that said, the SiteData endpoint is a Site Collection level enumeration, if you aren't the collection admin, you probably don't have access at that level... If you must use the old endpoints, try .../Webs.asmx to see if you have more luck. This is web level.

The REST equivalent to your endpoint above: https://mytenant.sharepoint.com/sites/MySite/_api/site

Here's a good starting point for SP REST.