Get Share ACL (FileREST API) - Azure Files

Article
02/01/2023

The Get Share ACL operation returns information about stored access policies that are specified on the share. For more information, see Define a stored access policy.

Protocol availability

Enabled file share protocol	Available
SMB
NFS

Request

The Get Share ACL request may be constructed as follows. We recommend that you use HTTPS. Replace myaccount with the name of your storage account:

Method	Request URI	HTTP version
GET/HEAD	`https://myaccount.file.core.windows.net/myshare?restype=share&comp=acl`	HTTP/1.1

URI parameters

The following additional parameters may be specified on the request URI:

Parameter	Description
`timeout`	Optional. The `timeout` parameter is expressed in seconds. For more information, see Set time-outs for Azure Files operations.

Request headers

The required and optional request headers are described in the following table:

Request header	Description
`Authorization`	Required. Specifies the authorization scheme, account name, and signature. For more information, see Authorize requests to Azure Storage.
`Date or x-ms-date`	Required for all authorized requests. Specifies the version of the operation to use for this request. This operation is available only in version 2015-02-21 and later. For more information, see Versioning for the Azure Storage services.
`x-ms-version`	Required for all authorized requests. Specifies the version of the operation to use for this request. For more information, see Versioning for the Azure Storage services.
`x-ms-client-request-id`	Optional. Provides a client-generated, opaque value with a 1-kibibyte (KiB) character limit that's recorded in the logs when logging is configured. We highly recommend that you use this header to correlate client-side activities with requests that the server receives. For more information, see Monitor Azure Files.
`x-ms-lease-id:<ID>`	Optional. Version 2020-02-10 and later. If the header is specified, the operation is performed only if the file share's lease is currently active and the lease ID that's specified in the request matches the lease ID of the file share. If there's no match, the operation fails with status code 412 (Precondition Failed).

Request body

None.

Response

The response includes an HTTP status code, a set of response headers, and a response body.

Status code

A successful operation returns status code 200 (OK).

For more information about status codes, see Status and error codes.

Response headers

The response for this operation includes the following headers. The response may also include additional standard HTTP headers. All standard headers conform to the HTTP/1.1 protocol specification.

Response header	Description
`ETag`	Contains a value that you can use to perform operations conditionally. The value is enclosed in quotation marks.
`Last-Modified`	Any operation that modifies the share or its properties or metadata updates the last modified time. Operations on files don't affect the last modified time of the share.
`x-ms-request-id`	Uniquely identifies the request that was made and can be used to troubleshoot the request. For more information, see Troubleshoot API operations.
`x-ms-version`	Indicates the Azure Blob Storage version that was used to execute the request. Returned for requests that are made against version 2009-09-19 or later.
`Date` or `x-ms-date`	A UTC date/time value that's generated by the service, which indicates the time when the response was initiated.
`x-ms-client-request-id`	Can be used to troubleshoot requests and corresponding responses. The value of this header is equal to the value of the `x-ms-client-request-id` header if it's present in the request and the value contains no more than 1,024 visible ASCII characters. If the `x-ms-client-request-id` header isn't present in the request, it won't be present in the response.

Response body

If a share-level access policy has been specified for the share, Get Share ACL returns the signed identifier and access policy in the response body.

<?xml version="1.0" encoding="utf-8"?>  
<SignedIdentifiers>  
  <SignedIdentifier>  
    <Id>unique-value</Id>  
    <AccessPolicy>  
      <Start>start-time</Start>  
      <Expiry>expiry-time</Expiry>  
      <Permission>abbreviated-permission-list</Permission>  
    </AccessPolicy>  
  </SignedIdentifier>  
</SignedIdentifiers>

Sample response

Response Status:  
HTTP/1.1 200 OK  
  
Response Headers:  
Transfer-Encoding: chunked  
Date: <date>  
ETag: "0x8CAFB82EFF70C46"  
Last-Modified: <date>  
x-ms-version: 2015-02-21  
Server: Windows-Azure-File/1.0 Microsoft-HTTPAPI/2.0  
  
<?xml version="1.0" encoding="utf-8"?>  
<SignedIdentifiers>  
  <SignedIdentifier>   
    <Id>MTIzNDU2Nzg5MDEyMzQ1Njc4OTAxMjM0NTY3ODkwMTI=</Id>  
    <AccessPolicy>  
      <Start>2015-07-01T08:49:37.0000000Z</Start>  
      <Expiry>2015-07-02T08:49:37.0000000Z</Expiry>  
      <Permission>rwd</Permission>  
    </AccessPolicy>  
  </SignedIdentifier>  
</SignedIdentifiers>

Authorization

Only the account owner may call this operation.

Remarks

The Access policy of the share applies to all of its share snapshots also. An access policy can't be set or retrieved for a share snapshot. If an attempt is made to retrieve an access policy, the service returns status code 400 (Invalid Query Parameter Value).

Get Share ACL