HTTP 403 Forbidden error for getchanges REST API call

Question

I'm new to sharepoint and stuck with the below issue:

Objective: To query for changes (updated or deleted list items) from Sharepoint online sites using REST API from a C# Console application.

I tried to construct below URL using HTTP Post:

https://site1.sharepoint.com/_api/web/getchanges

And the item payload is passed as follows:

     var itemPayload = new {query = new { __metadata = new {type ="SP.ChangeQuery" },
Update=true,Item=true } };

The above code works fine for "site1", however, when I try the same for "site2", which has bunch of sub sites under site collection like below:

https://site2.sharepoint.com/sites/customer1/_api/web/getchanges

I'm getting 403 forbidden error as response:

{StatusCode: 403, ReasonPhrase: 'FORBIDDEN', Version: 1.1, Content: ..}

However, when I tried ChangeQuery using CSOM library, the call works fine. I am passing the same user credentials for both REST query and CSOM.

This leads to my question whether my user credential require any special "permission" to get "changes" using REST (or) whether I'm doing anything wrong with my approach.

I looked into other forum posts, but I could not find out solutions similar to site2.

Kindly help.

Update: I have appended some part of code related to header, as per suggestion from Mr.Melvin and Mr.Peter (Thanks to both for your time and help)

HttpResponseMessage response;
var itemPayload = new {query = new { __metadata = new {type ="SP.ChangeQuery" },
Update=true,Item=true } };

var requestContent = new 
StringContent(JsonConvert.SerializeObject(itemPayload));
                    requestContent.Headers.ContentType = 
MediaTypeHeaderValue.Parse("application/json;odata=verbose");
DefaultRequestHeaders.Add("X-RequestDigest", AppendFormDigest());

if (headers != null)
{
 foreach (var header in headers)
   {
     DefaultRequestHeaders.Add(header.Key, header.Value);
   }
}  

var response = PostAsync(requestUri, requestContent).Result;
response.EnsureSuccessStatusCode();
responseContent = response.Content.ReadAsStringAsync().Result;


public string AppendFormDigest()
    {
        var contextInfoUrl = string.Format("{0}/_api/contextinfo", BaseAddress);
        var result = this.PostAsync(contextInfoUrl, new StringContent(string.Empty)).Result;
        result.EnsureSuccessStatusCode();
        var content = result.Content.ReadAsStringAsync().Result;
        var contentJson = JObject.Parse(content);
        return contentJson["d"]["GetContextWebInformation"]["FormDigestValue"].ToString();
    }

Answer 1

About this issue, it's caused by the digest.

Did you get the digest in your code?

You need to get the digest, after that, you can get the user permission in your code.

This is a reference about how to use SharePoint REST using HTTPClient.