MS OneDrive – Get Library Item Permissions

Lists permissions visible to the calling identity for the selected item. Permission visibility is determined by Microsoft and item access; do not assume every caller receives the same permission details. Select can restrict the response. The local Get Item Permission From Permission Items helper can find an entry in the returned collection.

Action details

Property	Value
Action label	MS OneDrive – Get Library Item Permissions
Category	CloudTools
Apex class and method	GetOneDriveLibraryItemPermissions.getLibraryItemPermissions
Input type	GetOneDriveLibraryItemPermissions.GetOneDriveLibraryItemPermissionsInput
Output type	List<List<MSGraphDrivePermission>>
Authorization	OAuth Delegated (Authorization Code) or OAuth Application (Client Credentials).
Flow automation	Use an application connector configured as the Flow default.
Microsoft Graph operation	GET /v1.0/drives/{driveId}/items/{itemId}/permissions for Authorization Code Flow; otherwise GET /v1.0/users/{userIdOrPrincipalName}/drives/{driveId}/items/{itemId}/permissions.

Prerequisites and permissions

Configure a CloudTools Connector with Connector Type set to Microsoft 365. For delegated access, complete the current user’s Microsoft sign-in. For application access where supported, grant application permissions and administrator consent and provide the target user ID or principal name. The identity must have access to the selected drive and item.

Delegated calls generally require Files.Read; application calls generally require Files.Read.All. Broader file or site read/write permissions may also satisfy the operation. See the Microsoft operation and permissions reference.

Drive selection: For Authorization Code Flow, a populated driveId uses /drives/{driveId} and userIdOrPrincipalName is ignored. Other authorization types require userIdOrPrincipalName and use the user-scoped drive path shown above. A Library Id is a Graph drive ID and Item Id is an item within that drive; neither is a Salesforce record ID or browser URL.

Inputs

The table lists action labels, Apex field names, and Apex data types. Supply one non-null request with nonblank required text values.

Input	Apex field	Type	Required	Description
User Id or Principal Name	userIdOrPrincipalName	String	Unless Authorization Code Flow is enabled	User id or user principal name. Ignored for Authorization Code Flow.
Library Id	driveId	String	Yes	Library (drive) identifier.
Item Id	itemId	String	Yes	Library (drive) item identifier.
Select	selectQuery	String	No	Comma-separated properties to return. Supply only the OData value, without $select=, $top=, $orderby=, or a full URL. Microsoft validates support.

The global invocable input has no connectorId field. Direct subscriber Apex and Flow calls use CloudTools connector selection. This action does not resolve replacement tokens; resolve dynamic values before invocation. See Using Token Replacements.

Outputs

The global invocable method returns List<List<MSGraphDrivePermission>>, with one outer entry holding the collection for the first request. An empty lookup returns an empty inner list. In Apex, read results[0]; Flow receives a collection output. The LWC library returns a flat array.

The helper maps the response collection but does not follow or return @odata.nextLink. The result can contain only the first page. Top, where exposed, is a request page-size input rather than an exhaustive lookup. There is no continuation URL input.

Output	Apex field	Type	Description
id	id	String	Microsoft Graph resource identifier.
roles	roles	List<String>	Granted roles, such as read or write.
inheritedFrom	inheritedFrom	MSGraphDriveItemReference	Parent reference from which a permission is inherited.
grantedTo	grantedTo	MSGraphDriveIdentitySet	Original granted identity set.
grantedToV2	grantedToV2	MSGraphDriveIdentitySet	Granted identity set in the newer Graph shape.

Mapping limitation: MSGraphDrivePermission exposes only id, roles, inheritedFrom, grantedTo, and grantedToV2. It has no link, invitation, expirationDateTime, recipient-error, or rawJson field. In particular, Create Sharing Link can succeed without returning its link URL through this model. The LWC controller attempts to derive linkType, linkScope, linkWebUrl, and expirationDateTime from the mapped object, so those fields remain unavailable with the current model. Its rawJson serializes the mapped object and does not recover omitted Microsoft fields.

Use in Flow

Add MS OneDrive – Get Library Item Permissions in Flow Builder. Use a Microsoft 365 application connector configured as Set as default for Flow automations, supply the target user and resource IDs, and handle faults. Delegated connections are not supported for CloudTools Flow automation. This implementation processes only the first request; it is not a bulk operation.

Use in custom Apex

This subscriber-org example uses the Apptigent namespace. Replace all identifiers and run in a context that permits callouts with a configured connector. The example supplies the user for application access; omit it for an already-authorized delegated connector.

Apptigent.GetOneDriveLibraryItemPermissions.GetOneDriveLibraryItemPermissionsInput request =
    new Apptigent.GetOneDriveLibraryItemPermissions.GetOneDriveLibraryItemPermissionsInput();
request.userIdOrPrincipalName = 'REPLACE_WITH_MICROSOFT_USER_ID_OR_UPN';
request.driveId = 'REPLACE_WITH_DRIVE_ID';
request.itemId = 'REPLACE_WITH_ITEM_OR_PARENT_ID';

List<List<Apptigent.MSGraphDrivePermission>> results =
    Apptigent.GetOneDriveLibraryItemPermissions.getLibraryItemPermissions(
        new List<Apptigent.GetOneDriveLibraryItemPermissions.GetOneDriveLibraryItemPermissionsInput>{ request }
    );

List<Apptigent.MSGraphDrivePermission> items = results.isEmpty()
    ? new List<Apptigent.MSGraphDrivePermission>() : results[0];
System.debug(items.size());

The example leaves exception handling, authorization setup, and presentation or persistence of the result to the calling application.

Use in a Lightning Web Component

Use getOneDriveLibraryItemPermissions from msOneDriveConnectorLib, through MSOneDriveConnectorController. These repository c/ imports apply to an LWC in the same namespace. Complete connector authorization before use.

Connector selection limitation: The wrapper accepts a second connectorId argument, but the current controller/action path does not forward it to select the Graph connector for this operation. Calls use CloudTools default connector selection. Passing a connectorId does not guarantee that this action uses that record.

oneDriveActionExample.js

import { LightningElement } from 'lwc';
import { getOneDriveLibraryItemPermissions, MSOneDriveObjects } from 'c/msOneDriveConnectorLib';

export default class OneDriveActionExample extends LightningElement {
    connectorId = 'REPLACE_WITH_CONNECTOR_RECORD_ID';
    result = null;
    errorMessage = '';
    isRunning = false;
    completed = false;

    async handleRun() {
        if (this.isRunning) {
            return;
        }
        this.isRunning = true;
        this.errorMessage = '';
        try {
            const request = MSOneDriveObjects.inputs.getOneDriveLibraryItemPermissions();
            request.userIdOrPrincipalName = 'REPLACE_WITH_MICROSOFT_USER_ID_OR_UPN';
            request.driveId = 'REPLACE_WITH_DRIVE_ID';
            request.itemId = 'REPLACE_WITH_ITEM_OR_PARENT_ID';
            const result = await getOneDriveLibraryItemPermissions(request);
            if (!Array.isArray(result)) {
                throw new Error('The action did not return a usable result.');
            }
            this.result = result;
            this.completed = true;
        } catch (error) {
            this.errorMessage = error.requiresInteractiveAuthorization
                ? 'Sign in to Microsoft for the connector, then try again.'
                : error.message || 'The OneDrive action failed.';
        } finally {
            this.isRunning = false;
        }
    }
}

oneDriveActionExample.html

<template>
    <lightning-button label="Run action" onclick={handleRun}
        disabled={isRunning}></lightning-button>
    <p role="alert">{errorMessage}</p>
</template>

The library resolves to a flat array, without an outer Apex list.

The controller exposes id, rolesCsv, identity display names, and rawJson. Its link fields do not overcome the model limitation described above; do not assume result.linkWebUrl is populated.

For delegated sign-in, use getOneDriveAuthorizationState, beginOneDriveAuthorization, and createOneDriveOAuthMessageHandler. The example only reports errors. This controller path converts failures to plain Aura-handled messages, so requiresInteractiveAuthorization is not guaranteed. Use the authorization-state helper before calling and handle message-only failures.

Error handling and troubleshooting

Symptom	What to check
Required fields error	Provide a nonempty request list with a non-null first item and the required identifiers. Supply the user for non-delegated connectors.
Authorization or access denied	Check connector selection, Microsoft sign-in, consent, permission type, and access to the drive or item.
Resource not found	Verify driveId, itemId, and any version or permission ID. Keep related IDs associated with their source drive.
Missing fields or items	Check Select, item type, mapping limitations, and first-page behavior. Empty results and omitted fields are not proof that a resource does not exist.
Unexpected connector	Review the connector selection limitation above and the Microsoft 365 Flow default.
Operation rejected	Inspect the Microsoft error, item state, library capability, and tenant policy. Handle exceptions or structured Result failures in the caller.