Unauthorised Error Creating Sub Site with Workflow

Question

I'm trying to create subsites for items in a project list using a SharePoint Designer Workflow using the SharePoint REST API services, but each time I attempt to run the workflow I get the Response

"Unauthorized" (or sometimes a 401 or 403 error... I've tried a lot of fixes).

I am running the workflow and assigning permissions all using the administrator account so I don't think it's a user privileges error, but an issue with the app privileges. I know the app step was working (some of the time) because I have received emails from the workflow. I've tried so many different versions though that it's hard to tell if it's working at this point.

The subsites will be created under the projects site collection:

https://contoso.sharepoint.com/sites/projects/

which is of course the same address that the HTML POST call references...

but I have tried to add app permissions to the main site collection as well, just in case that could be an issue:

https://contoso.sharepoint.com/_layouts/15/appinv.aspx

I have looked through many of the resources available and tried everything I can think of:

• https://www.dmcinfo.com/latest-thinking/blog/id/8661/create-site-from-template-using-sharepoint-2013-workflow

• https://jaredmatfess.com/2016/05/04/creating-subsites-using-rest-api-from-sharepoint-designer-workflow/

• http://www.fabiangwilliams.com/2014/06/19/gotcha-on-sharepoint-designer-workflows-in-app-step/

Microsoft say they updated the XML permissions code sometime at the end of 2017: https://msdn.microsoft.com/en-us/library/office/jj822159.aspx

but I've tried copy pasting the code there and even trying to bypass the gotcha with the following XML:

<AppPermissionRequests AllowAppOnlyPolicy="true">
     <AppPermissionRequest Scope="http://sharepoint/content/sitecollection/web" Right="FullControl" />
     <AppPermissionRequest Scope="http://sharepoint/content/sitecollection" Right="FullControl" />
 </AppPermissionRequests>

but nothing seems to be working.

Could this be an issue with the app catalogue, or is there something I'm missing? Alternatively it could just be that Microsoft Products are garbage, but I need to check whether it's my fault first.

I'd appreciate any sort of assistance (but please don't mark as duplicate question and link to some irrelevant article).

Answer 1

Success

So, after a bunch of back and forth I managed to get a working version of this workflow running. I have placed an image of the workflow and it's parameters so that others whom might have hassles may benefit.

My workflow generates a subsite based on an existing list item but anyone should easily be able to swap out those variables.

Of course to run this workflow you would still have to go through the required steps:

Step 1 Enabling the Site feature "Workflows can use app permissions" (App step would otherwise be greyed out in sharepoint designer)

Step 2 Scrape the Site Template (Google will help you here)

Step 3 Set your workflow permissions - I tried different versions of this code but this is the only version I got to work...

Navigate to your app permissions page https://contoso.sharepoint.com/sites/collection/_layouts/15/appinv.aspx

Lookup Workflow ID Site>Site Settings>App Permissions (It's the number between | & @) (You may need to have a saved workflow to see this)

Insert the following code and trust the app:

<AppPermissionRequests AllowAppOnlyPolicy="true">
 <AppPermissionRequest Scope="http://sharepoint/content/sitecollection/web" Right="FullControl" />
 <AppPermissionRequest Scope="http://sharepoint/content/sitecollection" Right="FullControl" />

Notes

It's also important to note the correct URL for the api call (And remember that it's a POST call when creating the workflow)

I tried a bunch of different ones (along with streams of other attempts at workarounds) but the only one I got to work was:

[%Variable: RequestURL%]/_api/web/webinfos/add

which is equivalent to

https://contoso.sharepoint.com/sites/collection/_api/web/webinfos/add

I hope this helps someone else from losing hair...

Answer 2

Even with the permissions and the app step, you need to include the digest token in your HTTP action. Are you first POSTing to _api/contextinfo to get a token from inside of the app step, then including the token (from d/GetContextWebInformation/FormDigestValue in the response) in your HTTP action's X-RequestDigest header?

To get a little bit more info about the error, you can take the response dictionary (and headers) and email it to yourself from inside of workflow. That might shed some light on the issue. Also, a little more detail on how your workflow is set up would be helpful to troubleshoot this.