0

I am using http web service to break permission inheritance for current item.for that I am using the following sequence.

1) fetching Request Digest value using following rest api endpoint:

_spPageContextInfo.webAbsoluteUrl + "_api/contextinfo"

enter image description here

I am getting response code :OK for above query

2) Break Permission Inheritance using following endpoint(I am using above request digest in this query):

_spPageContextInfo.webAbsoluteUrl + "/_api/web/lists/getByTitle('listname')/items(itemId)/breakroleinheritance(copyRoleAssignments=true, clearSubscopes=true)"

enter image description here

I am getting response code :Forbidden for above query

Edit :Things I have already tried

  1. activating feature "workflow can use app permissions".
  2. grant full permissions for workflow.
  3. adding action in app step.
Improve this question
4
  • Forbidden means the account making the request doesn't have permission to do that.
    – Derek Gusoff
    Oct 3, 2018 at 18:20
  • What if the account is site collection admin ?
    – Gopal Zadafiya
    Oct 3, 2018 at 18:21
  • Is it subsite or site collection where you are creating your workflow?
    – Rohit Waghela
    Aug 8, 2020 at 8:39
  • Also share the XML you have used in the Permission Request XML field to grant full control permission to the workflow..
    – Rohit Waghela
    Aug 8, 2020 at 8:42

3 Answers 3

Reset to default
0

Please try enabling this site feature which will allow the workflow to make modifications to list.

enter image description here

Cheers,

-Drew

Improve this answer
1
  • I have already activated this feature
    – Gopal Zadafiya
    Oct 4, 2018 at 1:43
0

When I do it, I simply just use the parameter true like this:

/_api/web/lists(guid'#1')/items(#2)/breakroleinheritance(true)

This haven't failed me yet.

Improve this answer
7
  • I am using this query in designer workflow. I have tried the above URL too.
    – Gopal Zadafiya
    Oct 4, 2018 at 8:28
  • I do that as well. Simply replace "breakroleinheritance(copyRoleAssignments=true, clearSubscopes=true)" with "breakroleinheritance(true)" and call the endpoint like any other REST endpoint from a workflow
    – Morten K
    Oct 4, 2018 at 8:29
  • That's true. but right now I am getting "Response : {"error":{"code":"-2147024891, System.UnauthorizedAccessException","message":{"lang":"en-US","value":"Access denied. You do not have permission to perform this action or access this resource."}}"
    – Gopal Zadafiya
    Oct 4, 2018 at 8:33
  • You also have an x-request header I normally don't use. I only use accept and content-type headers. This at least is a known working format.
    – Morten K
    Oct 4, 2018 at 8:39
  • are you using app step or form digest value ? right now I am trying with app step only. Do we need to specify form digest value for app step ?
    – Gopal Zadafiya
    Oct 4, 2018 at 8:43
0

For reference I think the correct solution is to give the workflow app the necessary permissions

In summary

  • In Manage Site Feature, activate feature "workflow can use app step".
  • Now go to Site settings -> Site App Permissions , there you will find an entry for Workflow i.t|clientID@tenantID.
  • Copy the Client ID and give it full control over site/list etc. To know how to give workflow full access please follow this blog. SharePoint Blog: Item Level Permission - SPD Workflow 2013 - Part 2 . follow same steps as mentioned for SPD workflow.
    • Add the REST call into the App Step.

The reference is for Nintex but it still applies to OOTB workflows.

See https://community.nintex.com/t5/Nintex-for-Office-365/REST-API-Break-Role-Inheritance-Nintex-O365-not-working/m-p/59359

James

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.