I have a SharePoint site wich I named ''Portal'' and under Portal I have several communities (subsites).

For each subsite I disabled permission inheritance and I setted up the groups and roles manually.

On the portal main page, I list every community the user can access with this code :

        url: "/portal/_api/web/webs/?$select=title,ServerRelativeUrl,Created,effectivebasepermissions&$filter=(effectivebasepermissions/high%20gt%2032)&$orderby=Created desc",
        type: "GET",
        headers: {
            "accept": "application/json;odata=verbose"

It's basically a webpart and with a javascript file and a html file. Its not a sharepoint app and so far it works perfectly. When I log with an admin account it list every subsites and when I log with a test user who is Visitor (with Read permission) it list only a few subsites.

However, I also want to list all the communities (all the subsites), so I tought I could just do this :

        url: "/portal/_api/web/webs/",
        type: "GET",
        headers: {
            "accept": "application/json;odata=verbose"

It works with my admin account but it doesnt show anything with my test account, I get blank results. When I check the console I get a :

Failed to load resource: the server responded with a status of 403 (Forbidden)

I followed this example for reference.

When I try to access this on my browser I get this error :

<m:error xmlns:m="http://schemas.microsoft.com/ado/2007/08/dataservices/metadata">
<m:code>-2147024891, System.UnauthorizedAccessException</m:code>

How can I simply list all the subsites even if the user dont have the permission to access the subsites ?

4 Answers 4


Finally I changed the code a little :

 url: "/portal/_api/web/webs/?$select=title,ServerRelativeUrl",

And also I gave additionnal permission to my user :

Browse Directories

And everything works...

Update 2018: I found another way

url: '/portal/_api/web/GetSubwebs(nWebTemplateFilter=-1,nConfigurationFilter=-1)',
  • And this returns all subsites, including apps... How to filter out apps?
    – 23W
    Commented Sep 18, 2018 at 16:06
  • 1
    @23W I updated the solution. Maybe you will have more luck with this !
    – metraon
    Commented Sep 19, 2018 at 2:39

This link should give you all sites and subsites:

https://yoursharepointsite.com/_api/search/query?querytext='(contentclass:STS_Site) (contentclass:STS_Web)'&trimduplicates=false&rowlimit=5000&selectproperties='Title,Url,Path,ParentLink'

You may need to handle duplicates if they come.

  • The question was "How can I simply list all the subsites even if the user don't have the permission to access the subsites?" I don't think the search will provide sites the user has no access to. That is true for other REST queries as well, as long one does not use an account with elevated permissions, possibly in a self-implemented REST-endpoint.
    – pholpar
    Commented Feb 16, 2021 at 16:53

This worked for me (SharePoint 2019, Google Chrome, REST API):

    url: "/_api/web/getsubwebsfilteredforcurrentuser(nWebTemplateFilter=-1,nConfigurationFilter=-1)?$select=title,ServerRelativeUrl",
    headers: {  
        Accept: "application/json;odata=verbose"  
    async: false,
    success: function(data) {       
        var items; // Data will have user object    
        if (data != null) {  
            // console.log(data);
            items = data.d;         
    error: function(data) {  

This url used to get all sub sites to which the current user has access,

 http://<site url>/_api/web/getsubwebsfilteredforcurrentuser(nwebtemplatefilter=-1,nconfigurationfilter=0)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.