In my .NET Core API I'm trying to update a document library item property with the SharePoint API. I already succeeded to get the document library item by id and by filter. When I try to update an item property, it returns a 403: Forbidden status with the message

The security validation for this page is invalid. Click Back in your Web browser, refresh the page, and try your operation again.

Although the user that I use to authenticate to SharePoint has full access.

The code that I'm using, can be found below. I've tried to change the request headers in every combination. For the X-HTTP-METHOD, MERGE or PUT, for IF-MATCH * or the version I got by the GET call, ...

 var url = "https://sharepointsite/_api/web/lists/getbytitle(\'Document Signage\')/items(164)";

        var uri = new Uri(url);
        var credentialsCache = new CredentialCache();
        credentialsCache.Add(uri, "NTLM", new NetworkCredential(user, pwd, domain));
        var handler = new HttpClientHandler { Credentials = credentialsCache };
        var httpClient = new HttpClient(handler) { BaseAddress = uri };
        httpClient.DefaultRequestHeaders.ConnectionClose = false;
        httpClient.DefaultRequestHeaders.Accept.Add(new MediaTypeWithQualityHeaderValue("application/json"));

        var httpRequest = new HttpRequestMessage(HttpMethod.Get, httpClient.BaseAddress);
        HttpResponseMessage resp = await httpClient.SendAsync(httpRequest);

        if (resp.IsSuccessStatusCode)
            string result = resp.Content.ReadAsStringAsync().Result;
            var listItem = JsonConvert.DeserializeObject<SharePointListItemProperties>(result);

            string formDigestValue = await GetFormDigestValue();

            httpClient.DefaultRequestHeaders.Add("X-HTTP-Method", "MERGE");
            httpClient.DefaultRequestHeaders.Add("X-RequestDigest", formDigestValue);
            httpClient.DefaultRequestHeaders.TryAddWithoutValidation("IF-MATCH", "5");
            var httpUpdateRequest = new HttpRequestMessage(HttpMethod.Post, httpClient.BaseAddress);
            httpUpdateRequest.Content = new StringContent("{\'__metadata\': { \'type\': \'SP.Data.Document SignageItem\' }, \'Status1\': \'Completed\'}", Encoding.UTF8, "application/json");
            HttpResponseMessage respUpd = await httpClient.SendAsync(httpUpdateRequest);
            string result2 = respUpd.Content.ReadAsStringAsync().Result;

I've read that most of the cases where in javascript, but as said, because I call it from an API it's in C#.

Does anyone has a possible solution?

  • I have not worked with .net core api, but in javascript you get this error when your FormDigestValue is null.
    – P S
    Jun 19, 2019 at 13:45

1 Answer 1


In some posts I read to just take the first part of the FormDigestValue. After putting it completely in the header, adding the content header to "application/json;odata=verbose" and changing the IF-MATCH header to *.

httpClient.DefaultRequestHeaders.Add("IF-MATCH", "*"); var httpUpdateRequest = new HttpRequestMessage(HttpMethod.Post, httpClient.BaseAddress); httpUpdateRequest.Content = new StringContent("{\'__metadata\': { \'type\': \'SP.Data.Document_x0020_SignageItem\' }, \'Status1\': \'Sent\'}"); httpUpdateRequest.Content.Headers.ContentType = MediaTypeHeaderValue.Parse("application/json;odata=verbose");

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.