Sharepoint - How to Set Item Level Permission Using SharePoint Designer 2013 Work Flow?

The simple process of setting item level permission is not available for SharePoint 2013 workflows. The only way I was able to do was through REST api called under Appstep.

There are 2 calls made:

1. BreakRoleInheritance
2. AddRoleAssignment

This blog by Yuri Leontyev​ ​ over at spssite.pro can be a good start.

Excerpt:

BreakRoleInheritance​

BreakRoleInheritance is just not documented and can be used using POST request:

https://your_sp_site.sharepoint.com/_api/web/lists/getByTitle('Test')/breakroleinheritance(copyRoleAssignments=true, clearSubscopes=true)

where copyRoleAssignments – “if true, this method copies the role assignments of the parent securable object when breaking inheritance; otherwise, this method adds the current user to the permission level that is required to manage the list item.” clearSubscopes – “Indicates whether subscopes should be cleared or not.”

AddRoleAssignment​​

Instead of the Add there is AddRoleAssignment method that also can be called using POST request (NOTE: this method works incorrectly in RTM release of SharePoint 2013!!!! It checks user within current item and if user is not found (usually as we’ve just broken inheritance) throws an exception. In SharePoint Online and March CU it works as expected):

https://your_sp_site.sharepoint.com/_api/web/lists/getByTitle('Test')/roleassignments/addroleassignment(principalid=20,roleDefId=1073741828) 

where principalid is id of user or group within current site collection. You can get a list of users by executing using GET:

https://your_sp_site.sharepoint.com/_api/web/siteusers

roleDefId is internal id of Role Definition (Read, Contribute, Full Control and so on). You can get a list of available role definitions using GET:

​https://your_sp_site.sharepoint.com/_api/web/roledefinitions​

Please use this guide to Enable App step in SharePoint 2013 Workflow, once you make sure all is set upped well the above solution will work fine.

facing some Error they are

Yeah, This is possible in workflow using REST API. Below are the steps which you need to follow.

Step 1: Whatever REST you are writing that should be part of App Step.

Step 2: As shown in screen shot you will have to write your commands in a workflow. There are some variables which you need to assign.

Step 3: Very first, you need to build dictionary where as variable name is ContextHeaders in aboveshown screenshot.

Step 4: Next need to set API url in very next line. That API url should be something like https://YourSite/_api/contextinfo and HTTP method should be HTTP Post.

Step 5: Next you need to set Get and that should be like d/GetContextWebInformation/FormDigestValue

Step 6: Again you need to build your dictionary for request headers to make REST call to break inheritance.

Step 7: Next you need to set variable to whom you want to give permissions after breaking the inheritance. In example shown above, we are assign some group ids to variable userIds.

Step 8: Write REST to break the inheritance. Your REST should look like https://YourSite/_api/web/lists/getByTitle(%27YourListTitle%27)/items(%27[%Current Item:ID%]%27)/breakroleinheritance(copyRoleAssignments=false, clearSubscopes=true). HTTP Request Type will be HTTP POST.

As we are breaking item level inheritance that's why we are going with Current Item ID.

Step 9: You need to set variable roleDefinition. This role definition is for, what permission level you want to assign to particular user.group ID.

Step 10: For assigning unique permission to User/Group id, again you will have to make a REST call. your REST should look like https://YourSite/_api/web/lists/getByTitle(%27YoutListTitle%27)/items(%27[%Current Item:ID%]%27)/roleassignments/addroleassignment(principalid=[%Variable: Id%],roledefid=[%Variable: roleDefination%])

This is how you can break inheritance and assign unique permissions.

I hope this will help you. Still, if you have any thing, please write back.