Allow Sharepoint REST API app access to a singular list and nothing else

Question

By default the permissions of a sharepoint app seem limited to read/write/full control over the entire site.

I'm looking for a way to grant a supplier access to a list but do not want them to be able to access the information stored on the site other than the list.

Preferred solution would be to limit the app using user permissions like a regular user.

Answer 1

May be below solution will be help you achieve your goal.

Follow below step to assign unique permission on list

1. Open list on which you want to give unique permission
2. Go to List Setting -> click on Permissions for this list

3. Click Stop Inheriting Permission

   

4. Then it will look like as below

   

5. Then If you want remove existing user or group permission then you can remove it

6. Now, you can add/give permission to new user or group to access your list by click on Grant Permission from ribbon

   

Answer 2

I realize I've been looking in the wrong place entirely.

A quick google search provided me little (useable) information on using the REST API in user context, but this was due to my lack of knowledge with API's in general.

After Bharat's comment I realized that the problem was creating an app, and with some more googling I found the following answer from Lee Liu: https://stackoverflow.com/questions/50598598/the-oauth2-authentication-request-process-of-office-365-forwards-the-link-to-htt

This is exactly what I needed, I created a Cloud Only user (federated requires some extra steps it seems) and managed to get the digest token in the end.

With the REST API in user context I can follow Bharat's steps to exclude all permissions except the ones in the list.