title: Outlook Add-in REST call error
body: <p>I'm trying to mark (flag) a message using the Outlook rest API, but I keep getting error messages. I've tried with different rest URLs but it doesn't help - the errors just varies.</p>
  
  <p>Important values in the manifest for allowing this I believe are:</p>
  
  <pre><code>&lt;Requirements&gt;
      &lt;Sets&gt;
        &lt;Set Name="Mailbox" MinVersion="1.1" /&gt;
      &lt;/Sets&gt;
    &lt;/Requirements&gt;
  ...
  &lt;Permissions&gt;ReadWriteItem&lt;/Permissions&gt;
    &lt;Rule xsi:type="RuleCollection" Mode="Or"&gt;
      &lt;Rule xsi:type="ItemIs" ItemType="Message" FormType="Read" /&gt;
    &lt;/Rule&gt;
  ...
  &lt;VersionOverrides xmlns="http://schemas.microsoft.com/office/mailappversionoverrides" xsi:type="VersionOverridesV1_0"&gt;
      &lt;Requirements&gt;
        &lt;bt:Sets DefaultMinVersion="1.3"&gt;
          &lt;bt:Set Name="Mailbox" /&gt;
        &lt;/bt:Sets&gt;
      &lt;/Requirements&gt;
  </code></pre>
  
  <p>Here is the part I'm trying to do that causes error:</p>
  
  <pre><code>Office.context.mailbox.getCallbackTokenAsync({ isRest: true }, function (result)
  {
      if (result.status === "succeeded")
      {
          var accessToken = result.value;
          var itemId = getItemRestId();
          var restUrl = Office.context.mailbox.restUrl + "/api/v2.0/messages/" + itemId;
  
          var request = {
              url: restUrl,
              type: "PATCH",
              dataType: 'json',
              data: { "Flag": { "FlagStatus": "Flagged" } },
              headers: { 
                  "Authorization": "Bearer " + accessToken, 
                  "Conntent-Type": "application/json" 
              }
          };
  
          $.ajax(request)
              .done(function (item)
              {
                  // dome something
              })
              .fail(function (error)
              {
                  // handle error
              });
      }
      else
      {
          // handle error
      }
  });
  
  function getItemRestId()
  {
      if (Office.context.mailbox.diagnostics.hostName === 'OutlookIOS')
      {
          return Office.context.mailbox.item.itemId;
      }
      else
      {
          return Office.context.mailbox.convertToRestId(
              Office.context.mailbox.item.itemId,
              Office.MailboxEnums.RestVersion.Beta
          );
      }
  }
  </code></pre>
  
  <p>This code above will result in the error: </p>
  
  <pre><code>{"readyState":4,"responseText":"","status":404,"statusText":"Not Found"}
  </code></pre>
  
  <p>If I try to JSON.stringify() the data attribute of the request I get:</p>
  
  <pre><code>{"readyState":4,"responseText":"","status":404,"statusText":"Not Found"}
  </code></pre>
  
  <p>If I change the rest URL to (seen in older samples): </p>
  
  <pre><code>'https://outlook.office.com/api/beta/me/messages/'+ itemId;
  </code></pre>
  
  <p>And the headers attribute of the request to (seen in older samples):</p>
  
  <pre><code>headers: {
      'Authorization': 'Bearer ' + accessToken,
      'Content-Type': 'application/json'
  }
  </code></pre>
  
  <p>Then I get the following error instead:</p>
  
  <pre><code>{
    "readyState": 4,
    "responseText": "{\"error\":{\"code\":\"ErrorAccessDenied\",\"message\":\"The api you are trying to access does not support item scoped OAuth.\"}}",
    "responseJSON": {
      "error": {
        "code": "ErrorAccessDenied",
        "message": "The api you are trying to access does not support item scoped OAuth."
      }
    },
    "status": 403,
    "statusText": "Forbidden"
  }
  </code></pre>
  
  <p>Can anyone see what I'm doing wrong or missing here?</p>
  
  <p>I'm debugging in Outlook 2016 and the account is Office 365.</p>
  
  <p><strong>UPDATE: Fiddler outputs</strong></p>
  
  <p><strong>Here is the request my own sample sends (results in 403 Forbidden)</strong>
  <strong>Exact error:</strong> <em>{"error":{"code":"ErrorAccessDenied","message":"The api you are trying to access does not support item scoped OAuth."}}</em></p>
  
  <pre><code>PATCH https://outlook.office.com/api/beta/me/messages/AAMkAGNmMDllMTVhLTI3ZDctNDYxZS05ZWM5LTA3ZWQzMzYyNDBiOABGAAAAAAD6OQOAoKyKT6R02yYFe0bIBwD5fUzv7OgQQYAILztCFSSWAALg591rAAC382lxTQ2HQpUKZsAGTeWVAARPu37CAAA= HTTP/1.1
  Content-Type: application/json
  Accept: application/json, text/javascript, */*; q=0.01
  Authorization: Bearer &lt;long token code removed...&gt;
  Referer: https://localhost:44394/MessageRead.html?_host_Info=Outlook$Win32$16.02$da-DK
  Accept-Language: da-DK
  Origin: https://localhost:44394
  Accept-Encoding: gzip, deflate
  User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
  Host: outlook.office.com
  Content-Length: 33
  Connection: Keep-Alive
  Cache-Control: no-cache
  
  {"Flag":{"FlagStatus":"Flagged"}}
  </code></pre>
  
  <p><strong>Here is the request the demo project sends (results in 200 OK)</strong></p>
  
  <pre><code>PATCH https://outlook.office.com/api/beta/me/messages/AAMkAGNmMDllMTVhLTI3ZDctNDYxZS05ZWM5LTA3ZWQzMzYyNDBiOABGAAAAAAD6OQOAoKyKT6R02yYFe0bIBwD5fUzv7OgQQYAILztCFSSWAALg591rAAC382lxTQ2HQpUKZsAGTeWVAARPu37CAAA= HTTP/1.1
  Content-Type: application/json
  Accept: application/json, text/javascript, */*; q=0.01
  Authorization: Bearer &lt;long token code removed...&gt;
  Referer: https://&lt;company.domain.com&gt;:1443/outlookaddindemo/RestCaller/RestCaller.html?_host_Info=Outlook$Win32$16.02$da-DK
  Accept-Language: da-DK
  Origin: https://&lt;company.domain.com&gt;:1443
  Accept-Encoding: gzip, deflate
  User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
  Host: outlook.office.com
  Content-Length: 47
  Connection: Keep-Alive
  Cache-Control: no-cache
  
  {
    "Flag": {
      "FlagStatus": "Flagged"
    }
  }
  </code></pre>
  
  <p>The only difference I can see is that the 2nd request payload seems formatted for reading while data wise being identical to the previous one.</p>
  
  <p>I can't seem to find the problem here - I even made sure that both projects use the same version of JQuery.</p>