2

I am trying to get the ACL on a file via the rest api. I can get the contents of a file and make other rest calls but when I call:

https://foo.sharepoint.com/_api/Web/Lists(guid'...')/Items(...)/FirstUniqueAncestorSecurableObject?$expand=RoleAssignments

or just https://foo.sharepoint.com/_api/Web/RoleAssignments I get a 401 Unauthorized Entity response.

I have created an appPrinciple in the site, and during the oAuth initiation I am requesting the AllSites.Manage permission. Around a year ago this code worked - and I can't find anything that suggests that this is no longer allowed. Can anyone shed any light?

Improve this question
7
  • Are you using the same client secret as a year ago?
    – Sergei Sergeev
    Nov 11, 2016 at 10:15
  • Hi Kai, No this is a new appPrinciple I just created, using th _layouts/15/AppRegNew.aspx
    – PaulW
    Nov 11, 2016 at 10:18
  • Are you sure you can, for example, read list title? 401 normally says something wrong with authentication. 403 says something wrong with permissions
    – Sergei Sergeev
    Nov 11, 2016 at 12:30
  • Yes I can get full information for lists / sites etc, so foo.sharepoint.com/_api/web/lists(guid'...') works just fine. From There I can get the list item, and also the call to FirstUniqueAncestorSecurableObject on the list item works, just not when I expand to get RoleAssignments
    – PaulW
    Nov 11, 2016 at 13:28
  • Does your user have permissions to modify role assignments?
    – Sergei Sergeev
    Nov 11, 2016 at 13:40

1 Answer 1

Reset to default
1

I finally found out what I was doing wrong: It seems that to get RolePermissions you need a higher level of access than you can request from oAuth, you need to put those permissions onto the AppPrinciple you are using. From the admin site: e.g. https://foo-admin.sharepoint.com/_layouts/15/AppInv.aspx

Find your app then enter the following XML code into the box 'Permission Request XML' and click create - then authorise the app.

<AppPermissionRequests AllowAppOnlyPolicy="true">
<AppPermissionRequest Scope="http://sharepoint/content/tenant" Right="Read" />
<AppPermissionRequest Scope="http://sharepoint/content/sitecollection" Right="FullControl" />
<AppPermissionRequest Scope="http://sharepoint/content/sitecollection/web" Right="FullControl" /></AppPermissionRequests>
Improve this answer
2
  • Just an fyi, if you grant full control to the site collection, you don't need to do the same for web.
    – wjervis
    Nov 15, 2016 at 11:46
  • Well it worked for a couple of weeks then stopped working again with no changes on either side, also for QA with a completely separate deployment. All signs point to a bug on the sharepoint side.
    – PaulW
    Dec 2, 2016 at 15:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.