List of permissions needed for SharePoint REST calls

Question

I do a lot of SharePoint online work using REST calls. I often hit roadblocks when I get "access denied" type errors when code executes from different users.

Question) Basically is there a nice big list of SharePoint REST calls and the required permission level for a user to execute it?

For instance POST ListItemAllFields/breakroleinheritance requires Full Control on the item (I think) POST x requires y permissions

It would be so handy if MSDN or someone had a big list like this so developers can easily set the permissions of users correctly (without giving too much permission)

Question part 2) is Full Control the minimum permission level require to execute ListItemAllFields/breakroleinheritance? I think so from this article but it talks about add-in permissions (https://msdn.microsoft.com/en-us/library/office/dn495392(v=office.15).aspx)

Code:

$.ajax({
        url: "/sites/blah/_api/web/getfilebyserverrelativeurl('/sites/blah/Shared%20Documents/"+ docname +"')/ListItemAllFields/breakroleinheritance(false)",
        type: 'POST',
        headers: { 'X-RequestDigest':$('#__REQUESTDIGEST').val() },
            success: function (dataX) {
                alert(JSON.stringify(dataX));
            },
            error: function (dataX) {
                alert('FAIL' + JSON.stringify(dataX));
            }
    });

Answer 1

The rest api calls always runs on logged in user permissions. So we can map user permissions with role definitions

1. Full Control - Has full control - User can make any call under end point "_api/web"
2. Edit - Can add, edit and delete lists; can view, add, update and delete list items and documents. - User Can do any operation on list and list items and end point would be "_api/web/Lists"
3. Read - Can view pages and list items and download documents. - User can do Get operations on list items and end point would be "_api/web/Lists/getByTitle('')/Items

Question 2:is Full Control the minimum permission level require to execute

Yes, it requires full control access.

Answer 2

Whilst this is an old question, it came up when I searched for "sharepoint web permissions API" and the only existing answer is incomplete.

Using the default permissions it may be true that Edit is required, but Sharepoint (2013 at least) allows you to define your own roles using finer grained permissions as documented here: https://docs.microsoft.com/en-us/sharepoint/sites/user-permissions-and-permission-levels

For our needs, we ticked the box "Enumerate Permissions" which includes these dependant permissions: Browse Directories, View Pages, Browse User Information, Open.

Assigning that role to a user then resulted in them being able to use the REST endpoints for read-only operations as desired.