Answered

HTTP request to delete access to SharePoint list

(1) Share

Report

Posted on by MO-14070903-0

Hi all,

I want to remove the access to SharePoint list entries for all users but not for sharepoint groups. Therefore, I built the following flow. HTTP GET Type does only work for user but not for groups and is therefore used as a condition. It seems as everyting works up until HTTP POST Delete Access. It starts with getting all items and looking at item after item.

In the Apply to each I wrote: body('HTTP_GET_Rights')?['d']['results']}

and in HTTP GET Rights I wrote: _api/web/lists/getByTitle('Government incentives SP list')/items(items('For_each')?['ID'])/roleassignments

and in the HTTP POST Delete Rights I wrote: _api/web/lists/getByTitle('Government incentives SP list')/items(items('For_each')?['ID']/roleassignments/removeroleassignment(principalid=items('Apply_to_each')['PrincipalId'])

I do not understand why this does not work as the HTTP request seems working. Everything until the HTTP POST Delete Rights node works just fine.

Thank you very much for your help and kind regards,

Marc

Categories:

Building flows

I have the same question (0)

All responses (2)

Answers (1)

Sort by

Verified answer

Riyaz_riz11 4,150 Super User 2026 Season 1 on at

Like (1)

Report
Copy link

Link copied!
Hi,

SharePoint Permissions Removal - Corrected Solution

Issues with Your Current Approach

Missing closing parenthesis in your HTTP POST URI

Incorrect HTTP method - should be POST, not DELETE

Missing proper headers for the POST request

URI syntax errors in the removeroleassignment call

Corrected Solution

Step 1: HTTP GET Rights (Correct - No Changes Needed)

_api/web/lists/getByTitle('Government incentives SP list')/items(items('For_each')?['ID'])/roleassignments

Step 2: Apply to Each (Correct - No Changes Needed)

body('HTTP_GET_Rights')?['d']['results']

Step 3: HTTP GET Type (Correct - No Changes Needed)

This is used to check if the principal is a user or group.

Step 4: HTTP POST Delete Rights (CORRECTED)

Method: POST

URI:

_api/web/lists/getByTitle('Government incentives SP list')/items(@{items('For_each')?['ID']})/roleassignments/removeroleassignment(principalid=@{items('Apply_to_each')['PrincipalId']})

Headers:

json

{ "Accept": "application/json;odata=verbose", "Content-Type": "application/json;odata=verbose", "X-RequestDigest": "@{body('HTTP_GET_RequestDigest')?['d']['GetContextWebInformation']['FormDigestValue']}" }

Body: (Leave empty for this operation)

If I have answered your question, please mark it as the preferred solution ✅ . If you like my response, please give it a Thumbs Up 👍.
Regards,
Riyaz

Was this reply helpful? Yes No
MO-14070903-0 8 on at

Like (0)

Report
Copy link

Link copied!

Hi @Riyaz_riz11, thanks for your answer, the flow is fixed now :)

However, it is important to note, that HTTP_GET_RequestDigest must be a new node with a HTTP request. Interestingly, it is a POST request although you might think to use GET as we want to get information from the server. The URI for this node is _api/contextinfo. Furthermore, I used the following headers in the node:

{
"Accept": "application/json;odata=verbose",
"Content-Type": "application/json;odata=verbose"
}

Afterwards, I just had to add the headers you sent, and the removal of the permissions worked.

Was this reply helpful? Yes No