I feel like I am spinning in circles and can't figure out what I am missing. I have a SharePoint 2016 web application I am attempting to test the REST APIs through Postman with. I follow the guide I found at the following site to authenticate my requests. I get the FormDigestValue, add it to the X-RequestDigest header and make a subsequent request to get the lists on the site. Unfortunately, no matter what requests I make, I get the following response:

    "error": {
        "code": "-2147024891, System.UnauthorizedAccessException",
        "message": {
            "lang": "en-US",
            "value": "Access denied. You do not have permission to perform this action or access this resource."

I have gone to the site collection, checked the users permission and the user has Full control permissions. The application is Claims based authentication. Is there anything else that I may be missing to check to get this to work as it does in the guide?


This issue is about authentication.

You can enable Basic Authentification in IIS Settings, then in postman, select Basic Auth type and set your account name and password. enter image description here

Solution for 401 Unauthorized Error while Using configuring Postman to send REST request to SharePoint Server

  • Thanks, saved me a bunch of headaches. Simple change to make and as soon as I enabled basic authentication and went into postman and attempted a request, worked as expected. – Joe W Jul 31 '18 at 14:27

Yes that will not work until you are passing credentials or the authentication token in the request. Request digest value is used only to prevent the cross-site scripting and not to authenticate the user.

To authenticate the current logged-in user you have to send one more header to the request to pass the credentials as:

 xhrFields: { withCredentials: true }

And also you have to enable the URL Rewrite option in the IIS to prevent the preflight option from getting dropped. Please refer this LINK to get it done.

Hope that helps.

  • While I appreciate this advice, the answer provided is for requests from ajax and does not apply to Postman. I have not attempted calls from Ajax but will keep note of this if I do attempt to. – Joe W Jul 31 '18 at 14:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.