I'm new to sharepoint and stuck with the below issue:

Objective: To query for changes (updated or deleted list items) from Sharepoint online sites using REST API from a C# Console application.

I tried to construct below URL using HTTP Post:


And the item payload is passed as follows:

     var itemPayload = new {query = new { __metadata = new {type ="SP.ChangeQuery" },
Update=true,Item=true } };

The above code works fine for "site1", however, when I try the same for "site2", which has bunch of sub sites under site collection like below:


I'm getting 403 forbidden error as response:

{StatusCode: 403, ReasonPhrase: 'FORBIDDEN', Version: 1.1, Content: ..}

However, when I tried ChangeQuery using CSOM library, the call works fine. I am passing the same user credentials for both REST query and CSOM.

This leads to my question whether my user credential require any special "permission" to get "changes" using REST (or) whether I'm doing anything wrong with my approach.

I looked into other forum posts, but I could not find out solutions similar to site2.

Kindly help.

Update: I have appended some part of code related to header, as per suggestion from Mr.Melvin and Mr.Peter (Thanks to both for your time and help)

HttpResponseMessage response;
var itemPayload = new {query = new { __metadata = new {type ="SP.ChangeQuery" },
Update=true,Item=true } };

var requestContent = new 
                    requestContent.Headers.ContentType = 
DefaultRequestHeaders.Add("X-RequestDigest", AppendFormDigest());

if (headers != null)
 foreach (var header in headers)
     DefaultRequestHeaders.Add(header.Key, header.Value);

var response = PostAsync(requestUri, requestContent).Result;
responseContent = response.Content.ReadAsStringAsync().Result;

public string AppendFormDigest()
        var contextInfoUrl = string.Format("{0}/_api/contextinfo", BaseAddress);
        var result = this.PostAsync(contextInfoUrl, new StringContent(string.Empty)).Result;
        var content = result.Content.ReadAsStringAsync().Result;
        var contentJson = JObject.Parse(content);
        return contentJson["d"]["GetContextWebInformation"]["FormDigestValue"].ToString();
  • Add full code, not see header. Commented May 3, 2018 at 9:56

1 Answer 1


About this issue, it's caused by the digest.

Did you get the digest in your code?

You need to get the digest, after that, you can get the user permission in your code.

This is a reference about how to use SharePoint REST using HTTPClient.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.