Sharepoint API permissions and bitfields

Question

Hello,

i am trying to figure out whether a user ( currently logged in user ) has read access to drive item or not. That's my usecase. Given item id, drive id and file name, I need to figure out if user will be able to access it or not.

Sounds simple right?

I am able to log the user in, request some graph api scopes, including offline_access with which i get back the refresh_token which i am then able to swap for sharepoint token using the refresh_token grant. This works and i can access sharepoint item then.

Then I call this endpoint to retrieve effectiveBasePermissions

https://mydomain.sharepoint.com/sites/mySite/_api/web/getFileByServerRelativeUrl({file-path}/ListItemAllFields/effectiveBasePermissions

which returns a weird response that somehow looks like integers but it's not ... supposedly it's a bitfield and now i'm lost what to do with this.

the response:

{'d': {'EffectiveBasePermissions': {'High': '688',

'Low': '1006836463',

'__metadata': {'type': 'SP.BasePermissions'}}}}

I have found similar questions/answers here and here but i am not too good with java and those look like you need to hardcode a list of values and then cross reference which permission it is ?

I would like to avoid hardcoding any values and minimize the requests required to determine whether user has access or not ....

does anybody have any idea how to do this properly ?

question: would this be reliable enough? if i call graph-api 's get drive item endpoint which returns the item metadata and verify if the response is in fact item or some kind of error .... perhaps i could catch the "forbidden" error and just use this?

If the user has access, i will get the item back and if not, i will get the error.

would this be reliable enough or could cause false positives?

now if i could do this in bulk for like 5 items or so, that would be ideal.

Answer 1

Hi @Python Developer 7 ,

To determine if a user has read access to a drive item in SharePoint, one possible solution is to call the Graph API's get drive item endpoint and verify if the response is an item or an error. If the user has access, the response will be an item, and if not, it will be an error. This approach should be reliable enough, but it can not check access for multiple items at once.

GET /sites/{site-id}/lists/{list-id}/items/{item-id}

This indicates that the user has at least Sites.Read.All permission on item 2.

For your reference:

https://learn.microsoft.com/en-us/graph/api/listitem-get?view=graph-rest-1.0&tabs=http

As for the effectiveBasePermissions endpoint, the response is a bitfield that represents the permissions that the current user has on the item. You can interpret the bitfield by comparing it to the SP.BasePermissions enumeration in SharePoint. However, this approach may require hardcoding values or making too many requests, as you mentioned. It doesn't meet your requirements.

Good day!

---

If the answer is helpful, please click "Accept as Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

ok Thanks a lot!