SharePoint 2016 - 401 Unauthorized on REST requests

Question

I feel like I am spinning in circles and can't figure out what I am missing. I have a SharePoint 2016 web application I am attempting to test the REST APIs through Postman with. I follow the guide I found at the following site to authenticate my requests. I get the FormDigestValue, add it to the X-RequestDigest header and make a subsequent request to get the lists on the site. Unfortunately, no matter what requests I make, I get the following response:

{
    "error": {
        "code": "-2147024891, System.UnauthorizedAccessException",
        "message": {
            "lang": "en-US",
            "value": "Access denied. You do not have permission to perform this action or access this resource."
        }
    }
}

I have gone to the site collection, checked the users permission and the user has Full control permissions. The application is Claims based authentication. Is there anything else that I may be missing to check to get this to work as it does in the guide?

Answer 1

This issue is about authentication.

You can enable Basic Authentification in IIS Settings, then in postman, select Basic Auth type and set your account name and password.

Solution for 401 Unauthorized Error while Using configuring Postman to send REST request to SharePoint Server

Answer 2

Yes that will not work until you are passing credentials or the authentication token in the request. Request digest value is used only to prevent the cross-site scripting and not to authenticate the user.

To authenticate the current logged-in user you have to send one more header to the request to pass the credentials as:

 xhrFields: { withCredentials: true }

And also you have to enable the URL Rewrite option in the IIS to prevent the preflight option from getting dropped. Please refer this LINK to get it done.

Hope that helps.