How to replace the list item permission using SharePoint 2013 designer workflow. if it is by using REST API please explain me the step by step procedure.

The scenario is after an item created in a list, the permission of that particular item has to change as read only. How its possible. Help to achieve this.

Thanks in advance.

1 Answer 1


The simple process of setting item level permission is not available for SharePoint 2013 workflows. The only way I was able to do was through REST api called under Appstep.

There are 2 calls made:

  1. BreakRoleInheritance
  2. AddRoleAssignment

This blog by Yuri Leontyev​ ​ over at spssite.pro can be a good start.



BreakRoleInheritance is just not documented and can be used using POST request:

`https://your_sp_site.sharepoint.com/_api/web/lists/getByTitle('Test')/breakroleinheritance(copyRoleAssignments=true, clearSubscopes=true`)

where copyRoleAssignments – “if true, this method copies the role assignments of the parent securable object when breaking inheritance; otherwise, this method adds the current user to the permission level that is required to manage the list item.” clearSubscopes – “Indicates whether subscopes should be cleared or not.”


Instead of the Add there is AddRoleAssignment method that also can be called using POST request (NOTE: this method works incorrectly in RTM release of SharePoint 2013!!!! It checks user within current item and if user is not found (usually as we’ve just broken inheritance) throws an exception. In SharePoint Online and March CU it works as expected):


where principalid is id of user or group within current site collection. You can get a list of users by executing using GET:


roleDefId is internal id of Role Definition (Read, Contribute, Full Control and so on). You can get a list of available role definitions using GET:


Please use this guide to Enable App step in SharePoint 2013 Workflow, once you make sure all is set up well, the above solution will work fine.

Answer copied from How to Set Item Level Permission Using SharePoint Designer 2013 Work Flow?.

  • will this work on items of a document library as well? because I tried implementing it. But now once I upload a document , it doesn't lets me save meta-data associated with it and throws this exception in red color : The file DraftLibrary/abc.xlsx has been modified by i:0#.f|membership|[email protected] on 14 Nov 2016 22:36:20 -0800 , where abc is my document name and tahir is the login Id by which I am uploading the document.
    – mohd tahir
    Commented Nov 15, 2016 at 6:38
  • for document library you do not let document-check in unless metadata is filled. Likewise workflow will run on item updated not item created. Before workflow runs, check if item is check-in or not. This should solve your requirement on document library. Commented Nov 15, 2016 at 6:59
  • how do I achieve this "Before workflow runs, check if item is check-in or not. " ???????
    – mohd tahir
    Commented Nov 15, 2016 at 7:45
  • Let item updated workflow run, in the workflow add a step to check if item-checkin or not. Commented Nov 15, 2016 at 7:46
  • Okay, @Monica I am not able to get the role definitions by hitting the suggested api. When I try the same on my site rather than workflow. It responds with a bad request.
    – mohd tahir
    Commented Nov 15, 2016 at 10:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.