I have a SharePoint-hosted app which is querying list in host web. This list has enabled fine-grained permissions (item level security) and I am site collection admin.
When I try to query items (with cross domain library), only items created by me are returned. But if the query is "standard", it returns all items.
Cross domain call:
https://tenant-appweb.sharepoint.com/_api/SP.AppContextSite(@target)/web/lists/getByTitle('My List')/items?&$select=Id,Title,Author/Title&$expand=Author/Title&@target='https://tenant.sharepoint.com/sites/hostweb'
Standard call:
https://tenant.sharepoint.com/sites/hostweb/_api/web/lists/getByTitle('My List')/items?&$select=Id,Title,Author/Title&$expand=Author/Title
Is it known behavior or I'm missing something? Thanks