We have a Permissions groups of around 4k in our site collection. In the same site I have created a sub site and given the permissions up to 2k groups. Now when I try to get the groups data in the sub site I am getting all the 4K groups as they were in site collection level. I tried to filter them with permission level as we roledefid to know the permission of the group. But here when I try to get all the groups I am not getting roledefid property in the object. Is there any query to get roledefid to all the groups.

Code I used to get the groups:

    url = _spPageContextInfo.webAbsoluteUrl + "/_api/web/sitegroups";
    url: url,
    method: "GET",
    async: async,
    headers: {
        "Accept": "application/json; odata=verbose"
    success: function(data) {
    error: OnError

Result i am getting with properties:

AllowMembersEditMembership: true
AllowRequestToJoinLeave: false
AutoAcceptRequestToJoinLeave: false
Description: ""
Id: 1977
IsHiddenInUI: false
LoginName: "GroupName"
OnlyAllowMembersViewMembership: false
Owner: {__deferred: {…}}
OwnerTitle: "GroupName"
PrincipalType: 8
RequestToJoinLeaveEmailSetting: null
Title: "GroupName"
Users: {__deferred: {…}}
__metadata: {id: "url", uri: "url", type: "SP.Group"}
__proto__: Object

3 Answers 3


You won't be able to get this from the Site Group object alone. Your rest-call only retrieves group information (title, id, description and other metadata).

To retrieve permission levels you will need to do a couple of more calls. See Users, groups, and roles REST API reference to read more about RoleAssignment and RoleDefinition.

  • Should summarize how to get the roledefid and do a permission call here, in your post, instead of just linking to the answer. If that link were to move, this answer becomes nearly useless. Also, under RoleAssignment it only provides how to use roledefid to add or remove a role, not to get the roledefid. Using the RoleDefinitionCollection and getting it by the role's name would be the way to go, it appears, in the REST call, from that link: /_api/SP.AppContextSite(@target)/web/roledefinitions /getbyname('contribute')?@target='<host web url>'"
    – vapcguy
    Oct 20, 2021 at 16:21

You could try the below api call:


According to Microsoft documentation, you would want to get the Role Definition ID by doing this for your URL:

url = _spPageContextInfo.webAbsoluteUrl + "/_api/SP.AppContextSite(@target)/web/roledefinitions
/getbyname('contribute')?@target='<host web url>'";

Where you would replace <host web url> with your site collection that is hosting that role, perhaps another _spPageContextInfo.webAbsoluteUrl, but that target parameter is not required. It would probably equate to changing your url to:

url = _spPageContextInfo.webAbsoluteUrl + "/_api/web/roledefinitions/getbyname('contribute')";  // 'target' is not required and simply provides a redirect page

Note that this is a role, not a group. You assign roles to groups.

Microsoft supplies a full example function here, under the RoleDefinitionCollection GetByName method:

    url: "<app web url>/_api/SP.AppContextSite(@target)/web/roledefinitions/getbyname('contribute')?@target='<host web url>'",
    method: "GET",
    headers: { "accept": "application/json; odata=verbose" },
    success: successHandler,
    error: errorHandler

But your AJAX above should handle it.

It will not say roledefid, but simply id, and that number there in that property you get returned is what you need.

var items = data.d.results;
if (items.length > 0) { 
    for (var i=0; i < items.length; i++) {
        var id = items[0].id;

You would assign this role to a group using the AddRoleAssignment API and the ID you obtained.

Microsoft's example URL for the AJAX call:

"<app web url>/_api/SP.AppContextSite(@target)/web/roleassignments
/addroleassignment(principalid=21, roledefid=1073741827)
?@target='<host web url>'",

Which translates to:

url = _spPageContextInfo.webAbsoluteUrl + "/_api/web/roleassignments/addroleassignment(principalid=21, roledefid=1073741827)";

So you will also need the principal ID, which is the ID of the group you are assigning the role to, for which you would do a call on that group by name with a URL like:

url = _spPageContextInfo.webAbsoluteUrl + "/_api/web/sitegroups/getbyname('content site owners')";

Store its ID and use that ID as the principalid in the add role assignment call.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.