I am trying to get a workflow in a SharePoint-hosted app developed in Visual Studio 2012 to break the role inheritance of a list item but whatever I seem to try I get a response of "The security validation for this page is invalid. Click Back in your Web browser, refresh the page, and try your operation again."
I am using the HttpSend activity to do this. I have tried getting the form digest value and setting the X-RequestDigest header but this seems to make no difference. I have tried getting a security token through the GetS2SSecurityToken activity, and using it with HttpSend but it seems to make no difference either. Putting the sequence within an AppOnlySequence doesn't seem to work either. I've tried various different permission settings on the app without success.
In case it is relevant I am using an on-premises SharePoint 2013 environment.
Creating a similar workflow in SharePoint Designer seems to have worked okay, so I'm not sure what it is I'm doing wrong.
Any help would be appreciated. Thanks in advance.