1

I am trying to get the ACL on a file via the rest api. I can get the contents of a file and make other rest calls but when I call:

https://foo.sharepoint.com/_api/Web/Lists(guid'...')/Items(...)/FirstUniqueAncestorSecurableObject?$expand=RoleAssignments

or just https://foo.sharepoint.com/_api/Web/RoleAssignments I get a 401 Unauthorized Entity response.

I have created an appPrinciple in the site, and during the oAuth initiation I am requesting the AllSites.Manage permission. Around a year ago this code worked - and I can't find anything that suggests that this is no longer allowed. Can anyone shed any light?

  • Are you using the same client secret as a year ago? – Sergei Sergeev Nov 11 '16 at 10:15
  • Hi Kai, No this is a new appPrinciple I just created, using th _layouts/15/AppRegNew.aspx – PaulW Nov 11 '16 at 10:18
  • Are you sure you can, for example, read list title? 401 normally says something wrong with authentication. 403 says something wrong with permissions – Sergei Sergeev Nov 11 '16 at 12:30
  • Yes I can get full information for lists / sites etc, so foo.sharepoint.com/_api/web/lists(guid'...') works just fine. From There I can get the list item, and also the call to FirstUniqueAncestorSecurableObject on the list item works, just not when I expand to get RoleAssignments – PaulW Nov 11 '16 at 13:28
  • Does your user have permissions to modify role assignments? – Sergei Sergeev Nov 11 '16 at 13:40
0

I finally found out what I was doing wrong: It seems that to get RolePermissions you need a higher level of access than you can request from oAuth, you need to put those permissions onto the AppPrinciple you are using. From the admin site: e.g. https://foo-admin.sharepoint.com/_layouts/15/AppInv.aspx

Find your app then enter the following XML code into the box 'Permission Request XML' and click create - then authorise the app.

<AppPermissionRequests AllowAppOnlyPolicy="true">
<AppPermissionRequest Scope="http://sharepoint/content/tenant" Right="Read" />
<AppPermissionRequest Scope="http://sharepoint/content/sitecollection" Right="FullControl" />
<AppPermissionRequest Scope="http://sharepoint/content/sitecollection/web" Right="FullControl" /></AppPermissionRequests>
  • Just an fyi, if you grant full control to the site collection, you don't need to do the same for web. – wjervis Nov 15 '16 at 11:46
  • Well it worked for a couple of weeks then stopped working again with no changes on either side, also for QA with a completely separate deployment. All signs point to a bug on the sharepoint side. – PaulW Dec 2 '16 at 15:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.