In order to manage unique permissions for a Securable Object like List or File (via associated List Item) or Folder (via associated List Item) there is a common approach that you could consider:
- Break role inheritance for a securable object
- Add/remove the role assignment on the securable object [optional]
How to: set unique permissions for a File via REST
Step 1 Break role inheritance for a List Item
associated with File
Example:
url: /_api/web/GetFileByServerRelativeUrl('<file relative url>')/ListItemAllFields/breakroleinheritance(true)
method: POST
Headers:
Authorization: "Bearer " + accessToken
X-RequestDigest: form digest value
accept: "application/json;odata=verbose"
content-type: "application/json;odata=verbose"
JavaScript example:
function breakRoleInheritanceOfFile(webUrl,fileUrl,success,failure) {
$.ajax({
url: webUrl + String.format("/_api/web/GetFileByServerRelativeUrl('{0}')/ListItemAllFields/breakroleinheritance(true)",fileUrl),
type: "POST",
contentType: "application/json;odata=verbose",
headers: {
"Accept": "application/json;odata=verbose",
"X-RequestDigest": $("#__REQUESTDIGEST").val()
},
success: function (data) {
success(data);
},
error: function (data) {
failure(data);
}
});
}
Note: Specify copyRoleAssignments=false
in breakroleinheritance
method
to prevent copying the role assignments from the parent securable
object. In that case the collection of role assignments must contain only 1 role
assignment containing the current user after the operation
Step 2 (optional) Add/remove the role assignment on the List Item
Remove the current role assignment for the group on the File
:
url: /_api/web/GetFileByServerRelativeUrl('<file relative url>')/ListItemAllFields/roleassignments/getbyprincipalid(<groupId>)
method: POST
Headers:
Authorization: "Bearer " + accessToken
X-RequestDigest: form digest value
accept: "application/json;odata=verbose"
content-type: "application/json;odata=verbose"
'X-HTTP-Method':'DELETE'
Add the new role assignment for the group on the File
:
url: /_api/web/GetFileByServerRelativeUrl('<file relative url>')/ListItemAllFields/roleassignments/addroleassignment(principalid=<groupId>,roledefid=<targetRoleDefinitionId>)
method: POST
Headers:
Authorization: "Bearer " + accessToken
X-RequestDigest: form digest value
accept: "application/json;odata=verbose"
content-type: "application/json;odata=verbose"
References
How to: Set custom permissions on a list by using the REST interface