function UpdateListNoJQuery(listTitle, hide) { var list = { "__metadata": { "type": 'SP.List' }, "Hidden": hide }; var data = JSON.stringify(list); //request digest is required by post queries (security page validation) var requesetDisgest = document.getElementById("__REQUESTDIGEST").value; var xhr = new XMLHttpRequest(); var postUrl = _spPageContextInfo.webAbsoluteUrl + "/_api/web/lists/getbytitle('" + listTitle + "')"; xhr.open('POST', postUrl); console.log(postUrl); xhr.setRequestHeader("Accept", "application/json; odata=verbose"); xhr.setRequestHeader("Content-type", "application/json;odata=verbose"); xhr.setRequestHeader("X-RequestDigest", requesetDisgest); xhr.setRequestHeader("X-HTTP-Method", "MERGE"); xhr.setRequestHeader("If-Match", "*"); xhr.setRequestHeader("data", data); //code 204 will say update succeded xhr.onload = function () { if (xhr.status === 204) { console.log("update succeded"); console.log(xhr.statusText); } else { console.dir(xhr); alert('Request failed. Returned status of ' + xhr.status); } }; console.dir(data); xhr.send(data); }