On SharePoint Online, I'm trying to query the SiteData.aspx web service to get all the content in a SharePoint site:

Endpoint: https://mytenant.sharepoint.com/sites/MySite/_vti_bin/SiteData.asmx

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:soap="http://schemas.microsoft.com/sharepoint/soap/">

I have rtfa and fedauth cookies present on the request, yet every time I get a response of: 403: Forbidden

My admins say I have been given the following permissions to this site:

  • View Items
  • Open Items
  • View Versions
  • View Application Pages
  • Site Permissions
  • View Web Analytics Data
  • Browse Directories
  • View Pages
  • Enumerate Permissions
  • Browse User Information
  • Use Remote Interfaces
  • Open
  • Edit Personal User Information

Why am I still getting 403 errors here? Is there some other permission I need to be granted?

1 Answer 1


I would recommend looking at changing to REST. The ASMX service was deprecated after SP2010 and is only still around for backwards compatibility. Deprecated Services

But, that said, the SiteData endpoint is a Site Collection level enumeration, if you aren't the collection admin, you probably don't have access at that level... If you must use the old endpoints, try .../Webs.asmx to see if you have more luck. This is web level.

The REST equivalent to your endpoint above: https://mytenant.sharepoint.com/sites/MySite/_api/site

Here's a good starting point for SP REST.

  • unfortunately this is our legacy app which has since been replaced by rest, but this still uses soap. Commented Feb 26, 2018 at 20:25
  • What is a site collection admin with respect to Sharepoint Online? Commented Feb 26, 2018 at 20:29
  • 1
    It's a little funny, because online has a flat architecture (ideally though not strictly) making everything a Site Collection. But for the purposes of the endpoints it is a permission thing. Basically you need to be a "Site Collection Admin" or greater to access Site Objects... If you go to site settings > Users and Permissions > Site Collection Administrators (this won't be there if you don't have permissions), you can verify if you have that level of permission. Web Objects should be available with the permissions above. Maybe the legacy code can be re-wired for that endpoint.
    – Ken Hansen
    Commented Feb 26, 2018 at 21:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.