How do I regain permission to a folder?

Every Google Drive file, folder, and shared drive have associated Permissions resources. Each resource identifies the permission for a specific type (user, group, domain, anyone) and role, such as "commenter" or "reader." For example, a file might have a permission granting a specific user (type=user) read-only access (role=reader) while another permission grants members of a specific group (type=group) the ability to add comments to a file (role=commenter).

To share a file or folder, the user must have the role of "writer." To share (add a member to) a shared drive, the user must have the role of "organizer."

For a complete list of roles and the operations permitted by each, refer to Roles.

Permission propagation

Permission lists for a folder propagate downward, and all child files and folders inherit permissions from the parent. Whenever permissions or the hierarchy is changed, the propagation occurs recursively through all nested folders. For example, if a file exists in a folder and that folder is then moved within another folder, the permissions on the new folder propagates to the file. If the new folder grants the user of the file a new role, such as "writer," it overrides their old role.

Conversely, if a file inherits the "writer" role from a folder, and is moved to another folder that provides a "reader" role, the file now inherits the "reader" role.

Inherited permissions can't be removed from a file or folder in a shared drive. Instead these permissions must be adjusted on the direct or indirect parent from which they were inherited. Inherited permissions can be removed from items under "My Drive" or "Shared with me."

Conversely, inherited permissions can be overridden on a file or folder in My Drive. So, if a file inherits the role of "writer" from a My Drive folder, you can set the role of "reader" on the file to lower its permission level.

Capabilities

The Permissions resource doesn't ultimately determine the current user's ability to perform actions on a file or folder. Instead, a Files resource contains a collection of boolean capabilities fields used to indicate whether an action can be performed on a file or folder. The Google Drive API sets these fields based on the current user's permissions resource associated with the file or folder.

For example, when Alex logs into your app and tries to share a file, Alex's role is checked in terms of permissions on the file. If the role allows them to share a file, the capabilities related to the file, such as canShare, are filled in relative to the role. If Alex wants to share the file, your app checks the capabilities to ensure canShare is set to true.

Create a permission

The following 2 fields are necessary when creating a permission:

• type—The type identifies the scope of the permission (user, group, domain, or anyone). A permission with type=user applies to a specific user whereas a permission with type=domain applies to everyone in a specific domain.

• role—The role field identifies the operations that the type can perform. For example, a permission with type=user and role=reader grants a specific user read-only access to the file or folder. Or, a permission with type=domain and role=commenter lets everyone in the domain add comments to a file. For a complete list of roles and the operations permitted by each, refer to Roles.

When you create a permission where type=user or type=group, you must also provide an emailAddress to tie the specific user or group to the permission.

When you create a permission where type=domain, you must also provide a domain to tie a specific domain to the permission.

To create a permission:

1. Use the permissions.create method with the fileId for the associated file or folder.
2. In the request body, identify the type and role.
3. If type=user or type=group, provide an emailAddress. If type=domain, provide a domain.

Retrieve all permissions for a file, folder, or shared drive

Use the permissions.list method to retrieve all permissions for a file, folder, or shared drive.

Verify user permissions

When your app opens a file, it should check the file's capabilities and render the UI to reflect the permissions of the current user. For example, if the user doesn't have a canComment capability on the file, the ability to comment should be disabled in the UI.

To check the capabilities, call files.get with the fileId and the fields parameter set to the capabilities field.

For further information on returning fields using the fields parameter, refer to Return specific fields for a file.

Determine the source of the role for shared drive files & folders

To change the role on a file or folder, you must know the source of the role. For shared drives, the source of a role can be based on membership to the shared drive, the role on a folder, or the role on a file.

To determine the source of the role for a shared drive, or items within that drive, call permissions.get with the fileId, the permissionId, and the fields parameter set to the permissionDetails field. To find the permissionId, use permissions.list with the fileId.

This field enumerates all inherited and direct file permissions for the user, group, or domain.

Change permissions

To change permissions on a file or folder, you can change the assigned role:

1. Call permissions.update with the permissionId of the permission to change and the fileId for the associated file, folder, or shared drive. To find the permissionId, use permissions.list with the fileId.

2. In the request, identify the new role.

You can grant permissions on individual files or folders in a shared drive even if the user or group is already a member. For example, Alex has the role of commenter as part of their membership to a shared drive. However, your app can grant Alex the writer role for a file in a shared drive. In this case, because the new role is more permissive than the role granted through their membership, the new permission becomes the effective role for the file or folder.

Revoke access to a file or folder

To revoke access to a file or folder, call delete with the fileId and the permissionId to delete the permission.

For items in "My Drive," it's possible to delete an inherited permission. Deleting an inherited permission revokes access to the item and child items, if any.

For items in a shared drive, inherited permissions cannot be revoked. Update or revoke the permission on the parent file or folder instead.

The delete operation is also used to delete permissions directly applied to a shared drive file or folder.

Transfer file ownership to another Google Workspace account in the same organization

Ownership of files existing in "My Drive" can be transferred from one Google Workspace account to another account in the same organization. An organization that owns a shared drive owns the files within it. Therefore, ownership transfers are not supported for files and folders in shared drives. Organizers of a shared drive can move items from that shared drive and into their own "My Drive" which transfers the ownership to them.

To transfer ownership of a file in "My Drive", do one of the following:

• Create a file permission granting a specific user (type=user) owner access (role=owner).

• Update an existing file's permission with the owner role and transfer ownership to the specified user (transferOwnership=true).

Transfer file ownership from one consumer account to another consumer account

Ownership of files can be transferred between one consumer account to another consumer account. However, Drive doesn't transfer ownership of a file between 2 consumer accounts until the prospective new owner explicitly consents to the transfer. To transfer file ownership from one consumer account to another consumer account:

1. The current owner initiates an ownership transfer by creating or updating the prospective new owner's file permission. The permission must include these settings: role=writer, type=user, and pendingOwner=true. If the new owner is creating a permission for the prospective owner, an email notification is sent to the prospective new owner indicating that they're being asked to assume ownership of the file.

2. The new owner accepts the ownership transfer request by creating or updating their file permission. The permission must include these settings: role=owner and transferOwnership=true. If the new owner is creating a new permission, an email notification is sent to the previous owner indicating that ownership has been transferred.

When a file is transferred, the previous owner's role is downgraded to writer.

Change multiple permissions with batch requests

We strongly recommend using batch requests to modify multiple permissions.

The following is an example of performing a batch permission modification with a client library.