In my situation, I have a site collection

`/sites/mysitecol` - site collection
  - `/sites/mysitecol/test1` - sub-site - my user has access to this site.
  - `/sites/mysitecol/test2` - sub-site - my user DOES NOT have access to this site.

So I'm writing a program that calls the SharePoint rest api and queries for all the /Webs in the site collection.

But because I do not have access to /test2, it gives me a 401-unauthorized when trying to list the /webs.

Is there some way to list the webs such that it only returns the ones my logged-in user has access to?

1 Answer 1


Try using the SP.Web.getSubwebsForCurrentUser Method

Here's the example given in the documentation.

<asp:Content ID="Main" ContentPlaceHolderID="PlaceHolderMain" runat="server">
<script type="text/ecmascript" language="ecmascript">

    var webCollection = null;
    function runCode() {

        var clientContext = new SP.ClientContext.get_current();
        if (clientContext != undefined && clientContext != null) {
            var web = clientContext.get_web();

            this.webCollection = web.getSubwebsForCurrentUser(null);

            clientContext.executeQueryAsync(Function.createDelegate(this, this.onQuerySucceeded), Function.createDelegate(this, this.onQueryFailed));

    function onQuerySucceeded() {
        var webInfo = 'Child sites of the current site: \n\n';
        var webEnumerator = this.webCollection.getEnumerator();
        while (webEnumerator.moveNext()) {
            var web = webEnumerator.get_current();
            webInfo += web.get_title() + '\n';

    function onQueryFailed(sender, args) {
        alert('Request failed. ' + args.get_message() + '\n' + args.get_stackTrace());


    <input id="Button1" type="button" value="Run Code" onclick="runCode()" />



It appears getSubwebsForCurrentUser works with the JavaScript Client Object Model but not with the REST API. For the REST API you need to instead use getSubwebsFilteredForCurrentUser. I wasn't able to find documentation on this method so I can't provide detailed guidance on the use of the parameters. I was able to get some sample code working.

This code is injected into a web part page using a Content Editor. It was tested in SharePoint Online.

  <button type="button" onclick="getSubwebs()">Get Sub Webs</button>

<script src="https://cdnjs.cloudflare.com/ajax/libs/jquery/2.2.4/jquery.min.js"></script>

<script type="text/javascript">
  function getSubwebs() {
    var url = _spPageContextInfo.webAbsoluteUrl +

    var call = jQuery.ajax({
      url: url,
      type: "GET",
      headers: {
        "Accept": "application/json;odata=verbose"
    call.done(function (data) {
    call.fail(function (jqXHR) {
  • yes this sounds like exactly what I need. I'll test it and approve if it works! Mar 14, 2022 at 15:14
  • @NicholasDiPiazza Please see the update I added to my answer if you're using the SharePoint REST API. Mar 14, 2022 at 15:27
  • I'll be using CSOM so if the first approach doesn't work, I'll fallback to the 2nd one Mar 14, 2022 at 16:00
  • yeah the csom approach worked fine. (first example). Mar 23, 2022 at 23:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.