I am using http web service to break permission inheritance for current item.for that I am using the following sequence.

1) fetching Request Digest value using following rest api endpoint:

_spPageContextInfo.webAbsoluteUrl + "_api/contextinfo"

enter image description here

I am getting response code :OK for above query

2) Break Permission Inheritance using following endpoint(I am using above request digest in this query):

_spPageContextInfo.webAbsoluteUrl + "/_api/web/lists/getByTitle('listname')/items(itemId)/breakroleinheritance(copyRoleAssignments=true, clearSubscopes=true)"

enter image description here

I am getting response code :Forbidden for above query

Edit :Things I have already tried

  1. activating feature "workflow can use app permissions".
  2. grant full permissions for workflow.
  3. adding action in app step.
  • Forbidden means the account making the request doesn't have permission to do that. – Derek Gusoff Oct 3 '18 at 18:20
  • What if the account is site collection admin ? – Gopal Zadafiya Oct 3 '18 at 18:21
  • Is it subsite or site collection where you are creating your workflow? – Rohit Waghela Aug 8 '20 at 8:39
  • Also share the XML you have used in the Permission Request XML field to grant full control permission to the workflow.. – Rohit Waghela Aug 8 '20 at 8:42

Please try enabling this site feature which will allow the workflow to make modifications to list.

enter image description here



  • I have already activated this feature – Gopal Zadafiya Oct 4 '18 at 1:43

When I do it, I simply just use the parameter true like this:


This haven't failed me yet.

  • I am using this query in designer workflow. I have tried the above URL too. – Gopal Zadafiya Oct 4 '18 at 8:28
  • I do that as well. Simply replace "breakroleinheritance(copyRoleAssignments=true, clearSubscopes=true)" with "breakroleinheritance(true)" and call the endpoint like any other REST endpoint from a workflow – Morten K Oct 4 '18 at 8:29
  • That's true. but right now I am getting "Response : {"error":{"code":"-2147024891, System.UnauthorizedAccessException","message":{"lang":"en-US","value":"Access denied. You do not have permission to perform this action or access this resource."}}" – Gopal Zadafiya Oct 4 '18 at 8:33
  • You also have an x-request header I normally don't use. I only use accept and content-type headers. This at least is a known working format. – Morten K Oct 4 '18 at 8:39
  • are you using app step or form digest value ? right now I am trying with app step only. Do we need to specify form digest value for app step ? – Gopal Zadafiya Oct 4 '18 at 8:43

For reference I think the correct solution is to give the workflow app the necessary permissions

In summary

  • In Manage Site Feature, activate feature "workflow can use app step".
  • Now go to Site settings -> Site App Permissions , there you will find an entry for Workflow i.t|clientID@tenantID.
  • Copy the Client ID and give it full control over site/list etc. To know how to give workflow full access please follow this blog. SharePoint Blog: Item Level Permission - SPD Workflow 2013 - Part 2 . follow same steps as mentioned for SPD workflow.
    • Add the REST call into the App Step.

The reference is for Nintex but it still applies to OOTB workflows.

See https://community.nintex.com/t5/Nintex-for-Office-365/REST-API-Break-Role-Inheritance-Nintex-O365-not-working/m-p/59359


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.