Change Permissions for SharePoint List item on New and Edit

[Anonymous]

Combining the steps from  https://www.portiva.nl/nl/portiblog/2019/10/21/set-list-item-level-permissions-in-sharepoint-using-f... and https://collab365.community/manage-permissions-sharepoint-list-item-using-microsoft-flow-add-contrib... I've have successfully broken permissions on a new item and set them as Read only for the creator and given edit rights to a SharePoint group.

But, we have a scenario where someone in the SharePoint group may need to "Reject" the item which will send an email to the user to make changes.
I was successful in writing the flow to add the "Contribute" rights back to the creator at that point.
But the "Clear Permission" step doesn't seem to work after the first run as now the user gets a permission setting of "Contribute, Read".
And once they resubmit the item, the automation doesn't reset them back to "Read Only". The Automation shows the clear permission step as running successfully, but it doesn't actually clear the permissions on an edit.

Anyone else ran into this scenario and know a fix.. 

[Anonymous · Accepted solution]

To get this to work for New Items, as well as after editing items I ended up with two Automation's. 

First Automation,  which runs on created items, first cleared permissions using: _api/lists/getByTitle('Listname')/items(ID)/breakroleinheritance(copyRoleAssignments=false,clearSubscopes=true)
Then, based on the Status field, added permissions as needed. Example:
Grant user edit rights:
_api/lists/getByTitle('Listname')/items(ID)/roleassignments/addroleassignment(principalid=VarUserID,roledefid=1073741827)
Grant group Full Control:
_api/lists/getByTitle('Listname')/items(ID)/roleassignments/addroleassignment(principalid=VarGroupName,roledefid=1073741829

Automation for modified items used the following to clear permissions:

Clear User from Permissions
/_api/web/lists/getbytitle('smsapvendorforms')/items(ID)/roleassignments/removeroleassignment(principalid =VarUserID)
Clear group from permissions

/_api/web/lists/getbytitle('smsapvendorforms')/items(ID)/roleassignments/removeroleassignment(principalid = VarGroupName)
Then, based on Status field, re-added permissions as needed.

[Jackywei_BDF]

@Anonymous 

Hi :

I failed to use your way to set sharepoint item read only permission after it was approved.

First, i clear up permission for user, then i add read only for user.

Please check screenshot for me.

And i got error info from power automation as following:

 "status": 400,
"message": "表达式“web/lists/getbytitle('财务预付款申请')/items(10)/roleassignments/removeroleassignment(principalid =*.*@beiers****.com)”invalid。\r\nclientRequestId: *******-fedd-4f4a-a004-55946928159a\r\nserviceRequestId: ******-9096-c000-bb02-7589901bee99",
"source": "https://xxxx/_api/web/lists/getbytitle('%E8%B4%A2%E5%8A%A1%E9%A2%84%E4%BB%98%E6%AC%BE%E7%94%B3%E8%AF%B7')/items(10)/roleassignments/removeroleassignment(principalid%20=x.x@beier*****.com)",
"errors": [
"-1",
"Microsoft.SharePoint.Client.InvalidClientQueryException"
]
}

Would you please tell me how to solve this issue?

Thank you very much:)

[VswaldBI]

你不能直接用principleid=Email, 你要先拿到principleid才行