SharePoint Rest Api - 403 when trying to update list item

Question

From a C# library I need to use the SP rest Api to upload a document to a document library then set properties for it.

I almost have this working by making the following sequence of calls:

1. Post to /contextinfo to get the FormDigestValue
2. Post the binary to /Files/Add including the digest in the header property X-RequestDigest
3. Get /ListItemAllFields the digest in the header property X-RequestDigest

The next call is a Post to _api/web/lists/GetByTitle('library name')/Items(157)

The same digest value is included in the header property X-RequestDigest as can be seen below:

POST 

https://xxx.uk/_api/web/lists/GetByTitle('AssetMgmtEfilesDemo')/Items(157) HTTP/1.1
Accept: application/json, application/xml; odata=verbose
X-HTTP-Method: MERGE
IF-MATCH: *
X-RequestDigest: 0x01426A9818F7145E12BC2E99246C7E00AC1A3905D27204C783107FDDE806D2629171FAD8DCC61008E109DD9948BEB4208DC62107B2336B1228ABA143A2D5B3C6,19 Feb 2019 15:20:44 -0000
Content-Type: application/json; charset=utf-8
Host: xxx.uk
Content-Length: 359
Expect: 100-continue

{  
   __metadata":{
                    "type":"SP.Data.AssetMgmtEfilesDemoItem"
   },
   "UPRN":"U1",
   "KeystoneDocType":"Document"
}

My problem is that for this request, I get a "403 forbidden" response.

Can anyone see where I went wrong?

Answer 1

Did you try getting a fresh new form digest value before making the post call ? form digest value do expire after some time (default 30 mins).

You can also check your permission on the specific list.

Answer 2

Sample code for your reference, call Rest API in C# code, reference System.Web.Extensions dll:

using System.Net;
using System.IO;
using System.Web.Script.Serialization;
static void Main(string[] args)
        {
            UpdateListItem();
        }
        public static string GetFormDigest()
        {
            string formDigest = null;

            string resourceUrl = "http://sp/sites/dev/_api/contextinfo";
            HttpWebRequest wreq = HttpWebRequest.Create(resourceUrl) as HttpWebRequest;
            wreq.UseDefaultCredentials = true;
            wreq.Method = "POST";
            wreq.Accept = "application/json;odata=verbose";
            wreq.ContentLength = 0;
            wreq.ContentType = "application/json";
            string result;
            WebResponse wresp = wreq.GetResponse();

            using (StreamReader sr = new StreamReader(wresp.GetResponseStream()))
            {
                result = sr.ReadToEnd();
            }

            var jss = new JavaScriptSerializer();
            var val = jss.Deserialize<Dictionary<string, object>>(result);
            var d = val["d"] as Dictionary<string, object>;
            var wi = d["GetContextWebInformation"] as Dictionary<string, object>;
            formDigest = wi["FormDigestValue"].ToString();

            return formDigest;

        }

        public static void UpdateListItem()
        {
            string result = string.Empty;
            Uri uri = new Uri("http://sp/sites/dev/_api/web/lists/getbytitle('AssetMgmtEfilesDemo')/items(1)");
            HttpWebRequest wreq = (HttpWebRequest)WebRequest.Create(uri);
            wreq.Credentials = CredentialCache.DefaultNetworkCredentials;

            wreq.Method = "POST";
            wreq.Accept = "application/json; odata=verbose";
            wreq.ContentType = "application/json; odata=verbose";
            wreq.Headers.Add("X-HTTP-Method", "MERGE");
            wreq.Headers.Add("IF-MATCH", "*");
            wreq.Headers.Add("X-RequestDigest", GetFormDigest());

            string stringData = "{'__metadata': { 'type': 'SP.Data.AssetMgmtEfilesDemoItem' }, 'Title': 'UpdatedViaRest','UPRN':'U1','KeystoneDocType':'Image'}";
            wreq.ContentLength = stringData.Length;
            StreamWriter writer = new StreamWriter(wreq.GetRequestStream());
            writer.Write(stringData);
            writer.Flush();

            WebResponse wresp = wreq.GetResponse();
            using (StreamReader sr = new StreamReader(wresp.GetResponseStream()))
            {
                result = sr.ReadToEnd();
            }


        }