I would like to create a 2013 workflow using Rest api call to break inheritance and change permissions on list items when they are created. This is in a Sharepoint Online environment.

Have anyone succeded to create such a workflow without using custom code ore downloading this solution: http://sp2013workflowactivities.codeplex.com/releases ?

I would really like a description of such a workflow, I can't for the life of me find any?

  • I found this to be the most straight-forward explanation of permissions setting in SPD 2013 workflows. I've not attempted it yet but was wondering if there is any documentation ANYWHERE that describes this at a dummies level? Book, URL forum, whatever. Oct 23, 2015 at 9:29

2 Answers 2


I have done this before....for fun actually as a learning exercise in a SharePoint Designer 2013 workflow for SharePoint Online using the REST API.

I'm sure that you know, but you need to make use of the 'Call HTTP Web Service' action within an App Step.

Use this REST endpoint to break permissions on the item:

/_api/web/lists/getByTitle('YOUR LIST TITLE HERE')/items('YOUR ITEM ID HERE')/breakroleinheritance(copyRoleAssignments=true,clearSubscopes=true)

Use this REST endpoint to assign permissions to a user:

/_api/web/lists/getByTitle('YOUR LIST TITLE HERE')/items('YOUR ITEM ID HERE')/roleassignments/addroleassignment(principalId='ID OF USER TO ASSIGN PERMISSIONS TO',roleDefId='PERMISSION ID')

Within these endpoints, only replace the single-quoted words in CAPS with your values or workflow variables, which is what I did. These should be the REST endpoints that you need to be off on your way. If you need more help or clarification, please post in this thread. I will check it from time to time to see the outcome. Have a good one!

Here is a link to invaluable information on this subject, which is what I also used some time ago to accomplish this task: http://spsite.pro/Blog/Post/3/SharePoint-2013-REST-API-%E2%80%93-How-to-set-Unique-Permissions-%28Item-Level-Permissions%29

  • Very nice, thank you so much! Now i just need to get the permission ID and group ID. Is it possible to get thiese by title? Oct 13, 2014 at 6:56
  • No problem. Sure, you can use /_api/web/roledefinitions?$select=name,description,id to get the permissions information and you can use /_api/web/sitegroups to get the information about groups. Let me know how it goes.
    – spguy
    Oct 13, 2014 at 14:50
  • Cool! I try to get the id by name, but nothing happens, do you see why? - This is what i use (Im new to rest api): _api/web/roledefinitions/getbyname('contribute')?$select=id Oct 13, 2014 at 20:28
  • Try this: /_api/web/roledefinitions?$filter=Name eq 'Contribute'&$select=name,id,description' for the permission ID and this /_api/web/sitegroups?$filter=Title eq 'Owners'&$select=id for the site group. Sorry for the late reply.
    – spguy
    Oct 14, 2014 at 3:20
  • When i use /_api/web/roledefinitions?$filter=Name eq 'Contribute'&$select=name,id,description i get this respons: {"odata.error":{"code":"-1, System.Collections.Generic.KeyNotFoundException","message":{"lang":"en-US","value":"The given key was not present in the dictionary."}}} Oct 14, 2014 at 19:09

using account which belongs to Site Members, I tried the above REST API to break the newly created list item by using its BdcIdentity, returned from successful REST POST I got this result:


my code: /_api/web/lists/getByTitle('ListName')/GetItemByStringId('__xxxxxxxxxxxx')/breakroleinheritance(copyRoleAssignments=false,clearSubscopes=true)

The POST was successful but if I open the list via Lists/ListName using a different account which is a site member also, I can still see the item created by the first account. I appreciate your thoughts on this.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.