Is it possible to set this with REST (or JSOM?)

(these are not exposed as properties in List REST endpoint: MSDN List)

I can set this:

with PowerShell:

$spList.ReadSecurity=2 # 1=read all items, 2=read items created by user
$spList.WriteSecurity=4 # 1=Create and edit All, 2=Create and edit Own items, 4=None
  • There is at least one reason for which you should avoid item level permissions : it affects page load performance. Not only that, there is also a limit of 50000 unique permissions per site collection. You should probably consider a better alternative. Maybe use an event receiver. Mar 12, 2016 at 7:42
  • 1
    I think this is a common misconception; This setting of Item Level Permissions is not the same as Item Level Security, with the latter your Break Security and use (custom) Permission Profiles (that's where the confusion starts with the word "Permission" having different meanings). Al the performance/50000 items comments are about Item Level Security Mar 13, 2016 at 13:14
  • 2
    Created separate question on this threshold / security / permission: sharepoint.stackexchange.com/questions/173845/… Mar 13, 2016 at 14:19
  • 2
    ReadSecurity and WriteSecurity are included in the SchemaXML that can be requested using REST API but I don't see any way to update the values with REST.
    – Suleyman
    May 31, 2016 at 8:56

2 Answers 2


It is possible to set or update ReadSecurity or WriteSecurity using REST API and JSOM both.


Request body

  "__metadata": {
    "type": "SP.List"
  "ReadSecurity": 2,
  "WriteSecurity": 4


/_api/web/lists/getbytitle('{List Name}')

You need to make an UPDATE request to above end-point with above request body. I have tested it using My SP REST Client.

enter image description here

More about ReadSecurity & WriteSecurity

ReadSecurity & WriteSecurity do not appear in response when you make a GET request to the list end-point but it returns all properties those are mentioned in MSDN. I mean following end-point

/_api/web/lists/getbytitle('{List Name}')

But if use $select operator in your query, then you will get the value of ReadSecurity & WriteSecurity. I mean following

/_api/web/lists/getbytitle('{List Name}')?$select=ReadSecurity,WriteSecurity

The reason is: these (ReadSecurity & WriteSecurity) properties are not returned with the resource. See more on Getting properties that aren't returned with the resource.


Set value using


Get value using

  • 3
    Thanks a lot. Apperently only works in SharePoin online, it does NOT work for ON PREM
    – Chris DS
    Mar 8, 2017 at 10:06

While the OP asks specifically for a REST or JSOM approach, there is another JavaScript option (which wraps the REST API anyway) using PNPJS and is compatible with SP Online. Adding this answer for completeness.

await sp.web.lists.getByTitle("My List").update({ ReadSecurity: 2, WriteSecurity: 2 } as IListInfo); //Sets to only allow users to set and read their own list items.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.