The SharePoint REST API lets you read and change SharePoint data with plain HTTP calls to the /_api/ address of any site. This GET request returns five orders from a list:
GET https://spguides.sharepoint.com/sites/SPGuides/_api/web/lists/getbytitle('SPGDemo Orders')/items?$select=ID,Title,OrderTotal&$top=5
Accept: application/json;odata=nometadataSend it signed in to the site and you get the rows back as JSON, with no SDK or library involved.
In this tutorial, we’ll run every common sharepoint rest api call on a real SharePoint Online site: the endpoint cheat sheet, headers, OData filters, list and item CRUD, folders and files, groups, and the errors you’ll hit.
What is the SharePoint REST API?
It’s a web service built into SharePoint (client.svc) that exposes sites, lists, items, files, users and groups as URLs. You call it with GET, POST and the other HTTP methods, and it answers in JSON or XML using the OData standard.
It covers the same objects as the CSOM client object model and JSOM in SharePoint, so anything that speaks HTTP can use it: browser JavaScript, SPFx, Power Automate, PowerShell, C# or Python.
It works in SharePoint Online and SharePoint Server. More developer guides sit on the SharePoint tutorials hub.
Every URL starts with the site address plus /_api/. From there you walk the object model: _api/site is the site collection and _api/web is the current site.
SharePoint REST API endpoints cheat sheet
Here are the endpoints I use most. Add them after https://spguides.sharepoint.com/sites/SPGuides/_api/; I tested each one on our site for this post:
| What you want | Method | Endpoint |
|---|---|---|
| Site collection | GET | site |
| Current site (title, language, URL) | GET | web?$select=Title,Language |
| All lists and libraries | GET | web/lists |
| One list by title or GUID | GET | web/lists/getbytitle('Orders') or web/lists(guid'...') |
| List columns | GET | web/lists/getbytitle('Orders')/fields |
| List items | GET | web/lists/getbytitle('Orders')/items |
| One item by ID | GET | web/lists/getbytitle('Orders')/items(2) |
| Create a list | POST | web/lists |
| Create / update / delete an item | POST / MERGE / DELETE | .../items, .../items(3) |
| Send an item to the recycle bin | POST | .../items(3)/recycle() |
| Create a folder | POST | web/folders |
| Upload a file | POST | web/GetFolderByServerRelativeUrl('...')/Files/add(url='a.txt',overwrite=true) |
| Download file content | GET | web/GetFileByServerRelativeUrl('...')/$value |
| Current user | GET | web/currentuser |
| Site users / groups | GET | web/siteusers, web/sitegroups |
| Members of a group | GET | web/sitegroups(30)/users |
| Form digest for writes | POST | contextinfo |
HTTP methods and headers the REST API expects
GET reads and POST creates. Updates and deletes are also sent as POST, with an X-HTTP-Method header that says what you really mean:
| Header | When | Value |
|---|---|---|
| Accept | Every call | application/json;odata=nometadata (lean) or odata=verbose (old d.results shape) |
| Content-Type | Calls with a body | Same family as Accept |
| X-RequestDigest | Writes from a browser session | FormDigestValue from /_api/contextinfo |
| X-HTTP-Method | Update or delete | MERGE, PUT or DELETE |
| IF-MATCH | Update or delete | The item’s ETag, or * to overwrite any version |
MERGE changes only the fields you send. PUT replaces the whole object, so optional fields you leave out go back to their defaults. I use MERGE for list items almost every time.
A missing or stale digest is the classic 403. The full fix is in the security validation error guide. Calls signed with an OAuth token, like PnP PowerShell, skip the digest.
How do I test a SharePoint REST API call in the browser?
Sign in to the site, then paste a GET URL in the address bar:
https://spguides.sharepoint.com/sites/SPGuides/_api/web/lists/getbytitle('SPGDemo Orders')/items?$select=ID,Title,CustomerName,OrderTotal&$top=3The browser doesn’t send a JSON Acc