Unable to retrieve RoleAssignments through Sharepoint Online REST API

Question

I am having a problem with retrieving RoleAssignments (for any object, web, list, folder etc.)

I have attempted to get it through:

1. https://[my_company].sharepoint.com/_api/Web/RoleAssignments

2. https://[my_company].sharepoint.com/_api/Web/Lists(guid'2924c92c-32db-4e55-b44f-638ca2b90f2e')/RoleAssignments

In both cases I get the following error:

{     code: "-2147024891, System.UnauthorizedAccessException"     
      message: {
        lang: "en-US"     
        value: "Access denied. You do not have permission to perform this action or access this resource."             
}}

I am currently getting my AccessToken using the following scope permissions:

"AllSites.Manage Site.Manage Web.Manage List.Manage AllProfiles.Manage"

Which is basically everything that seems somehow relevant...

I am getting valid responses for any other REST query I try, evertyhing except permission related info. I see a lot of questions about this error in different sharepoint forums - and no answer...

The App defined in Azure has ALL of the available permissions selected, both in Application and Delegated permissions lists.

The User I am giving the consent with is assigned both:

1. assigned as a SiteCollection Administrator
2. member of the "Team Site Owners" group

I would like to know what are the exact permissions required to access the RoleAssignments endpoint, and hopefully understand what I'm doing wrong...

Answer 1

You need to make sure that you have set groups property properly.

It should be so that everyone can see people in the groups. If its hidden to only group members then it will always throw access denied!

Also, if you are calling this from workflow make sure it's in an appstep.