title: SharePoint Online REST by using access_token still getting 403
body: <p>following this article <a href="http://www.ktskumar.com/2017/01/access-sharepoint-online-using-postman/" rel="nofollow noreferrer">http://www.ktskumar.com/2017/01/access-sharepoint-online-using-postman/</a>
  I was able to register an app and get a client_id as well as a security token.</p>
  <p>Now if I follow the article, I'm able to get an access token by using Postman, SOAP UI as well as by using a REST client in browser. I'm also able to fetch data from SharePoint using this token.</p>
  <p>However, I need to do this from a unix based middleware, which is able to do HTTP calls as well. I tried everything but I can't get it work.</p>
  <p>Preparation that has been done before:</p>
  <ol>
  <li>register new app by using https://.sharepoint.com/sites//_layouts/15/appregnew.aspx</li>
  <li>add app and permission to site collection to grant access by using https://.sharepoint.com/sites//_layouts/15/appinv.aspx</li>
  </ol>
  <p>After this, I do some webservice calls like this</p>
  <ol>
  <li><p>I try to get an access token by calling <a href="https://accounts.accesscontrol.windows.net/" rel="nofollow noreferrer">https://accounts.accesscontrol.windows.net/</a>&lt;mytenant_id&gt;/tokens/OAuth/2 and got one. I can use this token in every REST client as well as in Postman. So I assume it is a valid one.</p>
  </li>
  <li><p>Now I try to retrieve the Title of web by calling this URL https://&lt;my_tenant&gt;.sharepoint.com/sites/&lt;site_collection&gt;/_api/web?$select=Title</p>
  </li>
  </ol>
  <p>This always returns a 403 but only when using middleware system. If I do the same from any other client, it works.</p>
  <p>Could someone please enlight me what is going wrong here?</p>
  <p>This is how the request header looks like (I've shorten some things)</p>
  <pre><code>cookie'='fpc=...some other stuff; domain=.accounts.accesscontrol.windows.net; path=/; secure; HttpOnly; SameSite=None
  x-ms-gateway-slice=prod; path=/; SameSite=None; secure; HttpOnly
  stsservicecookie=ests; path=/; SameSite=None; secure; HttpOnly'
  
    'User-Agent'='Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0'
    'accept'='application/json;odata=verbose'
    'Authorization'='Bearer eyJ0eXAiOiJKV1QiLCJhbG... lot following here, but only value of access_token'
  </code></pre>
  <p>This is what the response looks like:</p>
  <pre><code>'RESPONSE_HTTP_HEADER_X-ASPNET-VERSION'='4.0.30319'
    'RESPONSE_HTTP_HEADER_LAST-MODIFIED'='Tue, 23 Jun 2020 08:10:42 GMT'
    'RESPONSE_HTTP_HEADER_X-SHAREPOINTHEALTHSCORE'='1'
    'RESPONSE_HTTP_HEADER_X-FORMS_BASED_AUTH_RETURN_URL'='https://&lt;mytenant&gt;.sharepoint.com/_layouts/15/error.aspx'
    'RESPONSE_HTTP_HEADER_CACHE-CONTROL'='private, max-age=0'
    'RESPONSE_HTTP_DATA'='&lt;?xml version=&quot;1.0&quot; encoding=&quot;utf-8&quot;?&gt;&lt;m:error xmlns:m=&quot;http://schemas.microsoft.com/ado/2007/08/dataservices/metadata&quot;&gt;&lt;m:code&gt;-2147024891, System.UnauthorizedAccessException&lt;/m:code&gt;&lt;m:message xml:lang=&quot;en-US&quot;&gt;Access denied. You do not have permission to perform this action or access this resource.&lt;/m:message&gt;&lt;/m:error&gt;'
    'RESPONSE_HTTP_HEADER_X-POWERED-BY'='ASP.NET'
    'RESPONSE_HTTP_HEADER_DATE'='Tue, 23 Jun 2020 08:10:42 GMT'
    'RESPONSE_HTTP_STATUSLINE'='Forbidden'
    'RESPONSE_HTTP_HEADER_EXPIRES'='Mon, 08 Jun 2020 08:10:42 GMT'
    'RESPONSE_HTTP_HEADER_CONTENT-SECURITY-POLICY'='frame-ancestors 'self' teams.microsoft.com *.teams.microsoft.com *.skype.com *.teams.microsoft.us local.teams.office.com;'
    'RESPONSE_HTTP_HEADER_MICROSOFTSHAREPOINTTEAMSERVICES'='16.0.0.20203'
    'RESPONSE_HTTP_HEADER_X-MSDAVEXT_ERROR'='917656; Access+denied.+Before+opening+files+in+this+location%2c+you+must+first+browse+to+the+web+site+and+select+the+option+to+login+automatically.'
    'RESPONSE_HTTP_HEADER_SPREQUESTGUID'='78265f9f-40b3-b000-f2bb-2df685280534'
    'RESPONSE_HTTP_HEADER_STRICT-TRANSPORT-SECURITY'='max-age=31536000'
    'RESPONSE_HTTP_HEADER_TRANSFER-ENCODING'='chunked'
    'RESPONSE_HTTP_HEADER_MS-CV'='n18meLNAALDyuy32hSgFNA.0'
    'RESPONSE_HTTP_HEADER_CONTENT-TYPE'='application/xml;charset=utf-8'
    'RESPONSE_HTTP_HEADER_P3P'='CP=&quot;ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI&quot;'
    'RESPONSE_HTTP_HEADER_X-FRAME-OPTIONS'='SAMEORIGIN'
    'RESPONSE_HTTP_HEADER_X-IDCRL_AUTH_PARAMS_V1'='IDCRL Type=&quot;BPOSIDCRL&quot;, EndPoint=&quot;/sites/&lt;sitecollection&gt;/_vti_bin/idcrl.svc/&quot;, RootDomain=&quot;sharepoint.com&quot;, Policy=&quot;MBI&quot;'
    'RESPONSE_HTTP_HEADER_SERVER'='Microsoft-IIS/10.0'
    'RESPONSE_HTTP_HEADER_REQUEST-ID'='78265f9f-40b3-b000-f2bb-2df685280534'
    'RESPONSE_HTTP_HEADER_X-MS-INVOKEAPP'='1; RequireReadOnly'
    'RESPONSE_HTTP_HEADER_X-CONTENT-TYPE-OPTIONS'='nosniff'
    'RESPONSE_HTTP_HEADER_X-FORMS_BASED_AUTH_REQUIRED'='https://&lt;mytenant&gt;.sharepoint.com/_forms/default.aspx?ReturnUrl=/_layouts/15/error.aspx&amp;Source=%2f_vti_bin%2fclient.svc%2fweb%3f%24select%3dTitle'
    'RESPONSE_HTTP_STATUS'='403'
    'RESPONSE_HTTP_HEADER_DATASERVICEVERSION'='3.0'
  </code></pre>
  <p>I also tried it with different HTTP Headers, by using cookies and by skip them. Nothing works from middleware but everything from my PC.</p>
  <p>Patrick</p>