I want to call this API -> /_api/SP.UserProfiles.PeopleManager/GetMyProperties from SharePoint provider hosted app, but whenever I'm calling this API what I got is 403 forbidden issue.

Here is my code

    ////retrieve current user profile details
    Uri targetWeb = new Uri(Request.QueryString["SPHostUrl"]);
    string targetRealm = TokenHelper.GetRealmFromTargetUrl(targetWeb);
    var responseToken = TokenHelper.GetAppOnlyAccessToken(TokenHelper.SharePointPrincipal, targetWeb.Authority, targetRealm);

    HttpWebRequest request = HttpWebRequest.CreateHttp(String.Format("{0}/_api/SP.UserProfiles.PeopleManager/GetMyProperties", Request["SPHostUrl"].Substring(0, 8 + Request["SPHostUrl"].Substring(8).IndexOf("/"))));
    request.Accept = "application/json;odata=verbose";
    request.Headers.Add("Authorization", String.Format("{0} {1}", responseToken.TokenType, responseToken.AccessToken));
    Stream s = request.GetResponse().GetResponseStream();

    using (StreamReader sr = new StreamReader(s))
    using (Newtonsoft.Json.JsonReader reader = new JsonTextReader(sr))
        JsonSerializer serializer = new JsonSerializer();

        // read the json from a stream
        // json size doesn't matter because only a small piece is read at a time from the HTTP request
        var p = serializer.Deserialize(reader);

catch (Exception ex){}

Thanks for the help!

  • Are you able to call any endpoints at all? Jul 14, 2018 at 4:52
  • able to call from the browser. Jul 14, 2018 at 5:09
  • no are you able to call any endpoints from your code Jul 14, 2018 at 5:10
  • I don't know if it resolves someone issue or not, but what happens when I give permission of full control on User profile I'm unable to call the API. After that I changed the permission to only read then I'm able to call the API and also able to access user profile properties. Thanks Jul 16, 2018 at 9:46

1 Answer 1


Looks like you forget to include the Request Digest header in your POST calls to SharePoint. Please refer the below code

//To get the request digest value.  
static async Task<string> GetDigestAsync(string endPoint, HttpClient client)
    string digest = null;
    HttpResponseMessage response = await client.PostAsync(endPoint, new StringContent(""));
    string jsonReturned = await response.Content.ReadAsStringAsync();
    JObject objReturned = JObject.Parse(jsonReturned);
    if (response.IsSuccessStatusCode)
        digest = await response.Content.ReadAsStringAsync();
    JObject rss = JObject.Parse(digest);

    return rss["d"]["GetContextWebInformation"]["FormDigestValue"].ToString();

//Make a post request to get the request digest value
var digest = await GetDigestAsync(siteUrl + "/_api/contextinfo", client);

//Now include this digest value as a header in your actual POST requests calls
client.DefaultRequestHeaders.Add("X-HTTP-Method", "POST");
client.DefaultRequestHeaders.Add("X-RequestDigest", digest);

Hope this will help you.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.