11

Is there a way to manage File permissions (roles) using the REST API?
http://msdn.microsoft.com/en-us/library/office/jj860569(v=office.15).aspx

I'm developing an app asking for permission on the fly:
http://msdn.microsoft.com/en-us/library/office/jj687470(v=office.15).aspx

I don't care about the way to do it... just want to upload a file to the SharePoint (already implemented that) - and then just make sure other users can't access it (before I delete it).

So any of these solutions will be just fine:

  • set permissions on the file itself
  • copy it to a folder and set permissions for that folder
  • create a 'document library' and set permissions for it (this seems to be doable when you have FullAccess rights - which is not possible to get using the REST API)
15

In order to manage unique permissions for a Securable Object like List or File (via associated List Item) or Folder (via associated List Item) there is a common approach that you could consider:

  • Break role inheritance for a securable object
  • Add/remove the role assignment on the securable object [optional]

How to: set unique permissions for a File via REST

Step 1 Break role inheritance for a List Item associated with File

Example:

url: /_api/web/GetFileByServerRelativeUrl('<file relative url>')/ListItemAllFields/breakroleinheritance(true)
method: POST      
Headers: 
   Authorization: "Bearer " + accessToken
   X-RequestDigest: form digest value
   accept: "application/json;odata=verbose"
   content-type: "application/json;odata=verbose"

JavaScript example:

function breakRoleInheritanceOfFile(webUrl,fileUrl,success,failure) { 
     $.ajax({
            url: webUrl + String.format("/_api/web/GetFileByServerRelativeUrl('{0}')/ListItemAllFields/breakroleinheritance(true)",fileUrl),
            type: "POST",
            contentType: "application/json;odata=verbose",
            headers: {
                "Accept": "application/json;odata=verbose",
                "X-RequestDigest": $("#__REQUESTDIGEST").val()
            },
            success: function (data) {
                success(data);
            },
            error: function (data) {
                failure(data);
            }
     });   
}

Note: Specify copyRoleAssignments=false in breakroleinheritance method to prevent copying the role assignments from the parent securable object. In that case the collection of role assignments must contain only 1 role assignment containing the current user after the operation

Step 2 (optional) Add/remove the role assignment on the List Item

Remove the current role assignment for the group on the File:

url: /_api/web/GetFileByServerRelativeUrl('<file relative url>')/ListItemAllFields/roleassignments/getbyprincipalid(<groupId>)
method: POST      
Headers: 
   Authorization: "Bearer " + accessToken
   X-RequestDigest: form digest value
   accept: "application/json;odata=verbose"
   content-type: "application/json;odata=verbose"
   'X-HTTP-Method':'DELETE'

Add the new role assignment for the group on the File:

url: /_api/web/GetFileByServerRelativeUrl('<file relative url>')/ListItemAllFields/roleassignments/addroleassignment(principalid=<groupId>,roledefid=<targetRoleDefinitionId>)
method: POST      
Headers: 
   Authorization: "Bearer " + accessToken
   X-RequestDigest: form digest value
   accept: "application/json;odata=verbose"
   content-type: "application/json;odata=verbose"

References

How to: Set custom permissions on a list by using the REST interface

  • 1
    The only comment is that in order to use this API you need 'FullControl' permissions, so you need to use the Azure AD to get access tokens. – palig Aug 28 '14 at 21:16
  • 1
    Thank you so much for "/ListItemAllFields" part of REST query, works great with getting folders by relative Url – Михаил Андреев Jul 10 '15 at 8:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.