I have a requirement where i need to check the access permission of a user against a List or Library only using REST api from my remote salesforce app.

Say for example, I have to send the list name and user name, and get the result as Read, Write, Contribute(Manage), None. I need to display what permission does that user have for that List.

How do I achieve this. Please help me. Thanks in advance.


Use EffectiveBasePermissions to get permissions of the user on a list. Example:


Note that this will give the permissions of the logged in user. However, if the need is to check for other users permission while being logged in using as a different user then as suggested by @Amit, use getusereffectivepermissions. In any case the end result is high and low permission masks which don't make much sense and a way to decipher what permissions a user has is to use SP.BasePermissions().has as can be seen in below example:

function checkPermissions() {
    var call = jQuery.ajax({
        url: _spPageContextInfo.webAbsoluteUrl +
        type: "GET",
        dataType: "json",
        headers: {
            Accept: "application/json;odata=verbose"

    call.done(function (data, textStatus, jqXHR) {
        var manageListsPerms = new SP.BasePermissions();

        var manageLists = manageListsPerms.has(SP.PermissionKind.manageLists);

        var message = jQuery("#message");
        message.text("Manage Lists: " + manageLists);

You could consider the following approach to get List permission levels/roles:

  • get the List effective permissions using /_api/web/lists/getbytitle('<list title>')/getusereffectivepermissions endpoint
  • determine user roles using SP.BasePermissions.has(perm) Method

JavaScript example

function getListUserEffectivePermissions(webUrl,listTitle, accountName) 
    var endpointUrl = webUrl +  "/_api/web/lists/getbytitle('" + listTitle + "')/getusereffectivepermissions(@u)?@u='" + encodeURIComponent(accountName) + "'";
    return $.getJSON(endpointUrl);

function parseBasePermissions(value)
    var permissions = new SP.BasePermissions();
    var permLevels = [];
    for(var permLevelName in SP.PermissionKind.prototype) {
        if (SP.PermissionKind.hasOwnProperty(permLevelName)) {
            var permLevel = SP.PermissionKind.parse(permLevelName);
    return permLevels;   


var webUrl = _spPageContextInfo.webAbsoluteUrl;  
            var roles = parseBasePermissions(data);


["emptyMask", "viewListItems", "addListItems", "editListItems", "deleteListItems", "openItems", "viewVersions", "deleteVersions", "managePersonalViews", "viewFormPages", "open", "viewPages", "createSSCSite", "browseDirectories", "browseUserInfo", "addDelPrivateWebParts", "updatePersonalWebParts", "useClientIntegration", "useRemoteAPIs", "createAlerts", "editMyUserInfo"]
  • Do you know why I would always get an "emptyMask" result? I've asked a similar question here – jasonscript Jul 29 '15 at 3:29
  • @vadim Gremyachev I'm trying to convert the parseBasePermissions to PowerShell, is that doable? – Eric Alexander Jul 22 '16 at 15:20
  • @Erik Alexander, that should be doable – Vadim Gremyachev Jul 22 '16 at 15:41
  • I'm not seeing how to do this: var permissions = new SP.BasePermissions(); permissions.initPropertiesFromJson(value); part. I don't see something that would allow me to supply the GetUserEffectivePermissions result like that. – Eric Alexander Jul 22 '16 at 17:34

Below is the REST endpoint for getting effective permission

/getusereffectivepermissions(@user)?@user='<user login name>'

Check below url: https://msdn.microsoft.com/en-us/library/office/dn531433(v=office.15).aspx#bk_ListGetUserEffectivePermissions


This should do the job you need:


Be aware, that there is no such as elevated permissions in the client side APIs, so the user executing the code should have the right to read permissions.

  • in your url .../_api/lists/getbytitle('yourlisttitle')/RoleAssignments/GetByPrincipalId(idOfTheUserOrGroup)/... What is "idOfTheUserOrGroup" ??? – Vikas Kottari Jan 22 '15 at 9:42
  • In my sample the idOfTheUserOrGroup is an integer, the ID property of the User or the Group whose role assignments on the list you would like to query. Be aware that this request queries the roles the user directly assigned to him on the list, and not the effective permissions of the user on the list (that you probably need) as suggested by @Amit. – pholpar Jan 22 '15 at 10:51
  • This doesn't work.'idOfTheUserOrGroup' has to be Id of the group. Say for example, i have a group named 'Managers' and now if i pass the id of this group to your REST url, it will work. But what i want is a user who belongs to 'Managers' group and i want to check his permission directly against the List. if is use 'getusereffectivepermissions' it will give me high and low permission bits. Not sure how to proceed with these bits. – Vikas Kottari Jan 27 '15 at 4:41
  • 'idOfTheUserOrGroup' may be the id of the person as well, as long as the person has the permissions assigned directly and not via a SP or AD group. For the usage of the 'getusereffectivepermissions' see the code sample from @Nadeem Yousuf. There you should create a BasePermissions instance based on the EffectiveBasePermissions in the response and you can check this agains the pre-defined permissions, like SP.PermissionKind.manageLists (but not to roles like Read / Write / Contribute as you wish). – pholpar Jan 27 '15 at 7:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.