I want to call this API -> /_api/SP.UserProfiles.PeopleManager/GetMyProperties from SharePoint provider hosted app, but whenever I'm calling this API what I got is 403 forbidden issue.

Here is my code

    ////retrieve current user profile details
    Uri targetWeb = new Uri(Request.QueryString["SPHostUrl"]);
    string targetRealm = TokenHelper.GetRealmFromTargetUrl(targetWeb);
    var responseToken = TokenHelper.GetAppOnlyAccessToken(TokenHelper.SharePointPrincipal, targetWeb.Authority, targetRealm);

    HttpWebRequest request = HttpWebRequest.CreateHttp(String.Format("{0}/_api/SP.UserProfiles.PeopleManager/GetMyProperties", Request["SPHostUrl"].Substring(0, 8 + Request["SPHostUrl"].Substring(8).IndexOf("/"))));
    request.Accept = "application/json;odata=verbose";
    request.Headers.Add("Authorization", String.Format("{0} {1}", responseToken.TokenType, responseToken.AccessToken));
    Stream s = request.GetResponse().GetResponseStream();

    using (StreamReader sr = new StreamReader(s))
    using (Newtonsoft.Json.JsonReader reader = new JsonTextReader(sr))
        JsonSerializer serializer = new JsonSerializer();

        // read the json from a stream
        // json size doesn't matter because only a small piece is read at a time from the HTTP request
        var p = serializer.Deserialize(reader);

catch (Exception ex){}

Thanks for the help!

  • Are you able to call any endpoints at all? – James Randal Jul 14 '18 at 4:52
  • able to call from the browser. – Utkarsh Dubey Jul 14 '18 at 5:09
  • no are you able to call any endpoints from your code – James Randal Jul 14 '18 at 5:10
  • I don't know if it resolves someone issue or not, but what happens when I give permission of full control on User profile I'm unable to call the API. After that I changed the permission to only read then I'm able to call the API and also able to access user profile properties. Thanks – Utkarsh Dubey Jul 16 '18 at 9:46

Looks like you forget to include the Request Digest header in your POST calls to SharePoint. Please refer the below code

//To get the request digest value.  
static async Task<string> GetDigestAsync(string endPoint, HttpClient client)
    string digest = null;
    HttpResponseMessage response = await client.PostAsync(endPoint, new StringContent(""));
    string jsonReturned = await response.Content.ReadAsStringAsync();
    JObject objReturned = JObject.Parse(jsonReturned);
    if (response.IsSuccessStatusCode)
        digest = await response.Content.ReadAsStringAsync();
    JObject rss = JObject.Parse(digest);

    return rss["d"]["GetContextWebInformation"]["FormDigestValue"].ToString();

//Make a post request to get the request digest value
var digest = await GetDigestAsync(siteUrl + "/_api/contextinfo", client);

//Now include this digest value as a header in your actual POST requests calls
client.DefaultRequestHeaders.Add("X-HTTP-Method", "POST");
client.DefaultRequestHeaders.Add("X-RequestDigest", digest);

Hope this will help you.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.