Get Permission

The Get Permission operation gets the Security Descriptor Definition Language (SDDL) for a given security descriptor. This API is available starting in version 2019-02-02.


The Get Permission request may be constructed as follows. HTTPS is recommended.

Method Request URI HTTP Version

Replace the path components shown in the request URI with your own, as follows:

Path Component Description
myaccount The name of your storage account.
myshare The name of your file share. Note that it may include only lower-case characters.

For details on path naming restrictions, see Naming and Referencing Shares, Directories, Files, and Metadata.

URI Parameters

The following additional parameters may be specified on the request URI.

Parameter Description
timeout Optional. The timeout parameter is expressed in seconds. For more information, see Setting Timeouts for Queue Service Operations.

Request Headers

The following table describes required and optional request headers.

Request Header Description
Authorization Required. Specifies the authorization scheme, storage account name, and signature. For more information, see Authorize requests to Azure Storage
Date or x-ms-date Required. Specifies the Coordinated Universal Time (UTC) for the request. For more information, see Authorize requests to Azure Storage.
x-ms-version Optional. Specifies the version of the operation to use for this request. For more information, see Versioning for the Azure Storage Services.
x-ms-file-permission-key Required. Security descriptor of the permission.
x-ms-client-request-id Optional. Provides a client-generated, opaque value with a 1 KiB character limit that is recorded in the analytics logs when storage analytics logging is enabled. Using this header is highly recommended for correlating client-side activities with requests received by the server. For more information, see Monitoring Azure Blob storage.

Request Body



The response includes an HTTP status code and a set of response headers.

Status Code

A successful operation returns status code 200 (OK).

For information about status codes, see Status and Error Codes.

Response headers

The response for this operation includes the following headers. The response may also include additional standard HTTP headers. All standard headers conform to the HTTP/1.1 protocol specification.

Response header Description
x-ms-request-id This header uniquely identifies the request that was made and can be used for troubleshooting the request.
x-ms-version Indicates the version of the File service used to execute the request.
Date or x-ms-date A UTC date/time value generated by the service that indicates the time at which the response was initiated.
x-ms-client-request-id This header can be used to troubleshoot requests and corresponding responses. The value of this header is equal to the value of the x-ms-client-request-id header if it is present in the request and the value is at most 1024 visible ASCII characters. If the x-ms-client-request-id header is not present in the request, this header will not be present in the response.

Response body

The response body is a JSON document that describes permission in the Security Descriptor Definition Language (SDDL).

    "Permission": "SDDL"

Sample response

HTTP/1.1 200 OK

Response headers:
x-ms-request-id: <id>
x-ms-date: Mon, 27 Jan 2014 22:15:50 GMT  
x-ms-version: 2014-02-14  

Response body:

{"permission": "O:S-1-5-21-2127521184-1604012920-1887927527-21560751G:S-1-5-21-2127521184-1604012920-1887927527-513D:AI(A;;FA;;;SY)(A;;FA;;;BA)(A;;0x1200a9;;;S-1-5-21-397955417-626881126-188441444-3053964)" }


Only the account owner or a caller having share level SAS with write and delete authorization may call this operation.