i have following problem. I am using SP 2013 Online and i am trying to access some informations from the sub site, like http://[SPOnlineUrl]/SubSite/_api/web/title. But i will always get the annoying

 {"error":{"code":"-2147024891, System.UnauthorizedAccessException","message": {"lang":"en-US","value":"Access denied. You do not have permission to perform this action or access this resource."}}}

Access Denied json Response.

The Workflow is manually started as Site Workflow at http://[SPOnlineUrl]/

I am using elevated workflow app-permissions explained in this msdn article with FullControl at SiteCollection level.

So, long story short, is it generally NOT possible to read/write Sub Site informations via the the REST interface and the Call a Web Service action from a Sharepoint 2013 Workflow (even with elevated permissions)?

Thanks for your help.

  • This is an old post, but I was able to do what the article suggested. Remember it is the HOST's workflow APPID in the othersite's appinv.aspx. Oct 31, 2014 at 14:03
  • @Hobbes1213 Please, mark if the answer was helpful.
    – Tito
    Jun 7, 2016 at 10:50

5 Answers 5


It is possible provided you've followed the instructions in the MSDN article. Doesn't matter where the site is (above/below in the current hierarchy or in a different site collection all together). Usually this error is because the app hasn't been given access to the target site... I'd verify you've granted it access, per the article instructions.

  • Hi Andrew, is it possible or is there an alternative to give app permissions programatically? I've found cumbersome to use templates with workflows for the creation of a new site as an admin needs to set it up for every new template site that uses a workflow with rest api. Thank you
    – Yugo
    Jul 26, 2019 at 18:36

As explained before, but I will summarize it in here, the user of the workflow can't make REST calls to other sites or subsites by default, you should give the sites and subsites the permission to the workflow to make those calls.

To be able to do it, first Allow your workflow to be used as an App by activating the feature Workflow can use app permissions on the site where the workflow is. Later you should go to the Site Settings > Site App Permissions. It is where you can copy it's id, the GUID between | and @ signs. And go to each subsite that will allow this app, that wrappes the workflow, to make REST calls. To go to that menu just go to the site: https://siteCol/subsite/_layouts/15/appinv.aspx

Later paste the GUID you just copied on the Application ID and click on find it. After that set up the permissions to:

       <AppPermissionRequest Scope="http://sharepoint/content/sitecollection" Right="FullControl" />

Caution: Use this literal values, don't substitute sitecollection on that url above.

Now you can make your REST calls without any problem, by placing your actions inside the step called "App Step" as shown in the image https://i-msdn.sec.s-msft.com/dynimg/IC630049.png

  • Worked perfectly! You should follow the same steps above even if you are using this in the same site collection.
    – Jake
    Oct 6, 2019 at 10:46

Here is the full MSDN article that explains the "how", though I'm still getting unauthorized in my web api calls after having implemented it.



You needs to give permission to workflow app on your site collection or web please take look into following link. its working.


  • Please quote main aspects of the article as links tend to go down. Dec 4, 2015 at 13:24

A caveat to permissions for SharePoint 2013 workflows - users initiating SP 2013 workflows must have a user profile synced in the User Profile Administration Service in Central Admin. If users are given permissions to a site/list/library via the AD security group that are part of, the User Profile Service needs to be aware that Security group exists or the 401 error will occur when a user in that group initiates a SP2013 workflow. This will even happen when an App Step is utilised.

To map an AD security group in the User Profile Service, it needs to be selected in the Containers section of the 'Configure Synchronization Connections'edit page.

In the Configure Synchronization Settings page, 'Users and Groups' should be selected' in the Synchronization Entities section.

A full sync/incremental profile sync is then required.

These two blog posts were of huge assistance in me figuring this out -



Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.