403: Forbidden when trying to update item properties with SharePoint API

Question

In my .NET Core API I'm trying to update a document library item property with the SharePoint API. I already succeeded to get the document library item by id and by filter. When I try to update an item property, it returns a 403: Forbidden status with the message

The security validation for this page is invalid. Click Back in your Web browser, refresh the page, and try your operation again.

Although the user that I use to authenticate to SharePoint has full access.

The code that I'm using, can be found below. I've tried to change the request headers in every combination. For the X-HTTP-METHOD, MERGE or PUT, for IF-MATCH * or the version I got by the GET call, ...

 var url = "https://sharepointsite/_api/web/lists/getbytitle(\'Document Signage\')/items(164)";

        var uri = new Uri(url);
        var credentialsCache = new CredentialCache();
        credentialsCache.Add(uri, "NTLM", new NetworkCredential(user, pwd, domain));
        var handler = new HttpClientHandler { Credentials = credentialsCache };
        var httpClient = new HttpClient(handler) { BaseAddress = uri };
        httpClient.DefaultRequestHeaders.ConnectionClose = false;
        httpClient.DefaultRequestHeaders.Accept.Add(new MediaTypeWithQualityHeaderValue("application/json"));

        var httpRequest = new HttpRequestMessage(HttpMethod.Get, httpClient.BaseAddress);
        HttpResponseMessage resp = await httpClient.SendAsync(httpRequest);

        if (resp.IsSuccessStatusCode)
        {
            string result = resp.Content.ReadAsStringAsync().Result;
            var listItem = JsonConvert.DeserializeObject<SharePointListItemProperties>(result);

            string formDigestValue = await GetFormDigestValue();

            httpClient.DefaultRequestHeaders.Add("X-HTTP-Method", "MERGE");
            httpClient.DefaultRequestHeaders.Add("X-RequestDigest", formDigestValue);
            httpClient.DefaultRequestHeaders.TryAddWithoutValidation("IF-MATCH", "5");
            var httpUpdateRequest = new HttpRequestMessage(HttpMethod.Post, httpClient.BaseAddress);
            httpUpdateRequest.Content = new StringContent("{\'__metadata\': { \'type\': \'SP.Data.Document SignageItem\' }, \'Status1\': \'Completed\'}", Encoding.UTF8, "application/json");
            HttpResponseMessage respUpd = await httpClient.SendAsync(httpUpdateRequest);
            string result2 = respUpd.Content.ReadAsStringAsync().Result;
        }

I've read that most of the cases where in javascript, but as said, because I call it from an API it's in C#.

Does anyone has a possible solution?

Answer 1

In some posts I read to just take the first part of the FormDigestValue. After putting it completely in the header, adding the content header to "application/json;odata=verbose" and changing the IF-MATCH header to *.

httpClient.DefaultRequestHeaders.Add("IF-MATCH", "*"); var httpUpdateRequest = new HttpRequestMessage(HttpMethod.Post, httpClient.BaseAddress); httpUpdateRequest.Content = new StringContent("{\'__metadata\': { \'type\': \'SP.Data.Document_x0020_SignageItem\' }, \'Status1\': \'Sent\'}"); httpUpdateRequest.Content.Headers.ContentType = MediaTypeHeaderValue.Parse("application/json;odata=verbose");