How to get roledefid along with sharepoint groups data using Rest API

Question

We have a Permissions groups of around 4k in our site collection. In the same site I have created a sub site and given the permissions up to 2k groups. Now when I try to get the groups data in the sub site I am getting all the 4K groups as they were in site collection level. I tried to filter them with permission level as we roledefid to know the permission of the group. But here when I try to get all the groups I am not getting roledefid property in the object. Is there any query to get roledefid to all the groups.

Code I used to get the groups:

    url = _spPageContextInfo.webAbsoluteUrl + "/_api/web/sitegroups";
$.ajax({
    url: url,
    method: "GET",
    async: async,
    headers: {
        "Accept": "application/json; odata=verbose"
    },
    success: function(data) {
        console.log(data);
    },
    error: OnError
});

Result i am getting with properties:

AllowMembersEditMembership: true
AllowRequestToJoinLeave: false
AutoAcceptRequestToJoinLeave: false
Description: ""
Id: 1977
IsHiddenInUI: false
LoginName: "GroupName"
OnlyAllowMembersViewMembership: false
Owner: {__deferred: {…}}
OwnerTitle: "GroupName"
PrincipalType: 8
RequestToJoinLeaveEmailSetting: null
Title: "GroupName"
Users: {__deferred: {…}}
__metadata: {id: "url", uri: "url", type: "SP.Group"}
__proto__: Object

Answer 1

You won't be able to get this from the Site Group object alone. Your rest-call only retrieves group information (title, id, description and other metadata).

To retrieve permission levels you will need to do a couple of more calls. See Users, groups, and roles REST API reference to read more about RoleAssignment and RoleDefinition.

Answer 2

You could try the below api call:

/_api/web/roleassignments?$expand=Member/users,RoleDefinitionBindings

Answer 3

According to Microsoft documentation, you would want to get the Role Definition ID by doing this for your URL:

url = _spPageContextInfo.webAbsoluteUrl + "/_api/SP.AppContextSite(@target)/web/roledefinitions
/getbyname('contribute')?@target='<host web url>'";

Where you would replace <host web url> with your site collection that is hosting that role, perhaps another _spPageContextInfo.webAbsoluteUrl, but that target parameter is not required. It would probably equate to changing your url to:

url = _spPageContextInfo.webAbsoluteUrl + "/_api/web/roledefinitions/getbyname('contribute')";  // 'target' is not required and simply provides a redirect page

Note that this is a role, not a group. You assign roles to groups.

Microsoft supplies a full example function here, under the RoleDefinitionCollection GetByName method:

executor.executeAsync({
    url: "<app web url>/_api/SP.AppContextSite(@target)/web/roledefinitions/getbyname('contribute')?@target='<host web url>'",
    method: "GET",
    headers: { "accept": "application/json; odata=verbose" },
    success: successHandler,
    error: errorHandler
});

But your AJAX above should handle it.

It will not say roledefid, but simply id, and that number there in that property you get returned is what you need.

var items = data.d.results;
if (items.length > 0) { 
    for (var i=0; i < items.length; i++) {
        var id = items[0].id;
    }
}

You would assign this role to a group using the AddRoleAssignment API and the ID you obtained.

Microsoft's example URL for the AJAX call:

"<app web url>/_api/SP.AppContextSite(@target)/web/roleassignments
/addroleassignment(principalid=21, roledefid=1073741827)
?@target='<host web url>'",

Which translates to:

url = _spPageContextInfo.webAbsoluteUrl + "/_api/web/roleassignments/addroleassignment(principalid=21, roledefid=1073741827)";

So you will also need the principal ID, which is the ID of the group you are assigning the role to, for which you would do a call on that group by name with a URL like:

url = _spPageContextInfo.webAbsoluteUrl + "/_api/web/sitegroups/getbyname('content site owners')";

Store its ID and use that ID as the principalid in the add role assignment call.