I am trying to get the ACL on a file via the rest api. I can get the contents of a file and make other rest calls but when I call:


or just https://foo.sharepoint.com/_api/Web/RoleAssignments I get a 401 Unauthorized Entity response.

I have created an appPrinciple in the site, and during the oAuth initiation I am requesting the AllSites.Manage permission. Around a year ago this code worked - and I can't find anything that suggests that this is no longer allowed. Can anyone shed any light?

  • Are you using the same client secret as a year ago? Commented Nov 11, 2016 at 10:15
  • Hi Kai, No this is a new appPrinciple I just created, using th _layouts/15/AppRegNew.aspx
    – PaulW
    Commented Nov 11, 2016 at 10:18
  • Are you sure you can, for example, read list title? 401 normally says something wrong with authentication. 403 says something wrong with permissions Commented Nov 11, 2016 at 12:30
  • Yes I can get full information for lists / sites etc, so foo.sharepoint.com/_api/web/lists(guid'...') works just fine. From There I can get the list item, and also the call to FirstUniqueAncestorSecurableObject on the list item works, just not when I expand to get RoleAssignments
    – PaulW
    Commented Nov 11, 2016 at 13:28
  • Does your user have permissions to modify role assignments? Commented Nov 11, 2016 at 13:40

1 Answer 1


I finally found out what I was doing wrong: It seems that to get RolePermissions you need a higher level of access than you can request from oAuth, you need to put those permissions onto the AppPrinciple you are using. From the admin site: e.g. https://foo-admin.sharepoint.com/_layouts/15/AppInv.aspx

Find your app then enter the following XML code into the box 'Permission Request XML' and click create - then authorise the app.

<AppPermissionRequests AllowAppOnlyPolicy="true">
<AppPermissionRequest Scope="http://sharepoint/content/tenant" Right="Read" />
<AppPermissionRequest Scope="http://sharepoint/content/sitecollection" Right="FullControl" />
<AppPermissionRequest Scope="http://sharepoint/content/sitecollection/web" Right="FullControl" /></AppPermissionRequests>
  • Just an fyi, if you grant full control to the site collection, you don't need to do the same for web.
    – wjervis
    Commented Nov 15, 2016 at 11:46
  • Well it worked for a couple of weeks then stopped working again with no changes on either side, also for QA with a completely separate deployment. All signs point to a bug on the sharepoint side.
    – PaulW
    Commented Dec 2, 2016 at 15:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.