Granting permissions on a group for a site

Question

I had successfully create groups and add users in it using REST API. These are the permissions on a SharePoint Group/User for a site:

*Full Control - Has full control.
*Design - Can view, add, update, delete, approve, and customize.
*Edit - Can add, edit and delete lists; can view, add, update and delete list                   
        items and documents.
*Contribute - Can view, add, update, and delete list items and documents.
*Read - Can view pages and list items and download documents.
*Create new sub sites - Can create new sub sites
*View Only - Can view pages, list items, and documents. Document types with server-side file handlers can be viewed in the browser but not downloaded.

Now how can I able to add permission to a certain SP group with any of the kind of the above privileges using REST API.

Answer 1

Try using the below code snippet to set permission for a group in a site:

function setPermissionForGroup(){
    $.ajax({
        url: _spPageContextInfo.webAbsoluteUrl + “/_api/web/roleassignments/addroleassignment(principalid=Enter Group Id, roledefid=1073741827)",
        type: "POST",
        contentType: "application/json;odata=verbose",
        headers: { "Accept": "application/json; odata=verbose","X-RequestDigest": $("#__REQUESTDIGEST").val(),"X-HTTP-Method": "POST" },
        success: function (data) {
            // Returning the results
               alert('Contribute permission set on group');
        },
        error: function (data) {
               alert("Error: " + JSON.stringify(data));
        }
        });
});

In the above example, pls replace the principalid with the group Id, to get the "principalid", navigate to your group and in the URL; you can find the "MembershipGroupId", which is "principalid".

I have given roledefid as "1073741827" which is "contribute" permission level.

roledefid for Permission Levels are as follows:

1073741829, Full Control

1073741827, Contribute

1073741826, Read

Answer 2

1. You need to first check if the list/site/subsite is inheriting any permission from its parent using :- /_api/web?$select=hasuniqueroleassignments

2. If it does inherit then use :- /_api/web/breakroleinheritance(copyRoleAssignments=true, clearSubscopes=true) this breaks the inheritance.

3. Then delete all existing permissions :- /_api/web/roleassignments/getbyprincipalid('IdNumber')

4. Assign permission :- /_api/web/roleassignments/addroleassignment(principalid='IdNumber', roledefid=1073741826)

where , 1073741829, Full Control

1073741827, Contribute

1073741826, Read