How can I cal the lists.asmx web service?

Eliasen, Jan 46 Reputation points

Hi all

I cannot seem to be able to call the lists.asmx web service (from a C# class library and could use some help.

The web service is hosted on on a URL like this:
I can browse to the URL of the site. And I can browse to the URL of the list that I actually want to retrieve data from.

I can also browse to the URL of the .asmx and I can add a service reference to it in Visual Studio.

When I add the service reference in Visual Studio, my app.config looks like this:
<binding name="ListsSoap">
<security mode="Transport" />
<binding name="ListsSoap1" />
<endpoint address="https://<company>"
binding="basicHttpBinding" bindingConfiguration="ListsSoap"
contract="ListsASMX.ListsSoap" name="ListsSoap" />

So the URL has changed a bit - the site name has been removed. Is this a problem? It doesn't seem to make any difference to me in my code.

So my code to call the web service looks like this:

System.Xml.XmlDocument xmlDoc = new System.Xml.XmlDocument();
            System.Xml.XmlElement query = xmlDoc.CreateElement("Query");
            System.Xml.XmlElement viewFields = xmlDoc.CreateElement("ViewFields");
            System.Xml.XmlElement queryOptions = xmlDoc.CreateElement("QueryOptions");

            query.InnerXml = "";
            viewFields.InnerXml = "";
            queryOptions.InnerXml = "";

            ListsASMX.ListsSoapClient client = new ListsASMX.ListsSoapClient();
                var result = client.GetListItems("<name of list>", "", query, viewFields, "150", queryOptions, null);
            catch (Exception ex)

But I get an exception saying that "{"The HTTP request was forbidden with client authentication scheme 'Anonymous'."}"

So I went to my app.config and changed this:

<security mode="Transport" />

to this:

<security mode="Transport">
       <transport clientCredentialType="None" />

That gave me the same error.
Then I tried with clientCredentialType = Windows. Then the error became: "{"The HTTP request was forbidden with client authentication scheme 'Negotiate'."}"
Then I tried with clientCredentialType = Ntlm. Then the error became: "{"The HTTP request was forbidden with client authentication scheme 'Ntlm'."}"

What am I doing wrong? I would just like to be able to retrieve data from the list <Name of list> using integrated security so I don't need to specify any credentials explicitly in my code.

Any help or pointers? I cna't seem to find anything on the internet that has this exact same issue.


A group of Microsoft Products and technologies used for sharing and managing content, knowledge, and applications.
9,518 questions
0 comments No comments
{count} votes

Accepted answer
  1. Jerryzy 10,561 Reputation points

    Hi @Eliasen, Jan ,

    SharePoint Online is using OAuth authentication instead of Windows/NTLM Authentication, needs the additional access token.

    So I suggest you could use SharePoint Online CSOM instead of Lists.asmx, as Lists.asmx is always used in SharePoint Sever environment and now Lists.asmx has been deprecated:


    Back to the requirement, if want to get the list item of a list, please try the following code snippet:

            string userName = "";  
            string AppPassword = "your password";  
            var securePassword = new SecureString();  
            foreach (char c in AppPassword)  
            using (var context = new ClientContext(""))  
                context.Credentials = new Microsoft.SharePoint.Client.SharePointOnlineCredentials(userName, securePassword);  
                Web web = context.Web;  
                List list = web.Lists.GetByTitle("MyList");  
                ListItemCollection items = list.GetItems(CamlQuery.CreateAllItemsQuery());  

    SharePoint Online CSOM can be download and install using Nuget:

    Install-Package Microsoft.SharePointOnline.CSOM -Version 16.1.20720.12000


    If an Answer is helpful, please click "Accept Answer" and upvote it.
    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

1 additional answer

Sort by: Most helpful
  1. Trevor Seward 11,681 Reputation points

    Lists.asmx is deprecated. Use REST API calls instead.

    You should also be using the Client ID/Secret (SharePoint Addin) or Graph API model and not username/password.