I have a SharePoint-hosted app which is querying list in host web. This list has enabled fine-grained permissions (item level security) and I am site collection admin.

When I try to query items (with cross domain library), only items created by me are returned. But if the query is "standard", it returns all items.

Cross domain call:

https://tenant-appweb.sharepoint.com/_api/SP.AppContextSite(@target)/web/lists/getByTitle('My List')/items?&$select=Id,Title,Author/Title&$expand=Author/Title&@target='https://tenant.sharepoint.com/sites/hostweb'

Standard call:

https://tenant.sharepoint.com/sites/hostweb/_api/web/lists/getByTitle('My List')/items?&$select=Id,Title,Author/Title&$expand=Author/Title

Is it known behavior or I'm missing something? Thanks

1 Answer 1


I found solution by myself. The App has only Write permission to web and it requires at least Manage.

App permissions

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.