Share via

How to retrieve the token for 'View Work Item in this Node' NamespaceId in Access Control List Rest API.

Yash Tiwari 135 Reputation points
2025-08-06T12:32:02.7966667+00:00

Hi Team,

To get the Access Control List for the Work Items 'View work item in node' this is the namespace id i fetched from the security namespaces API -> 

83e28ad4-2d72-4ceb-97b0-c7726d5502c3

The API endpoint i'm using is this:

https://dev.azure.com/{{organization}}/_apis/accesscontrollists/{{securityNamespaceId}}?**token=vstfs:///Classification/Node/6fa40c54-5847-4186-9f47-cb70c983285c:vstfs:///Classification/Node/4bb63716-9229-47ad-95c3-a9902c2b2a84**&descriptors={{descriptor}}&includeExtendedInfo=true&api-version={{api-version}}&inheritPermissions=true

I want to know how we can construct this composite token to use it in Access Control List API.

Please guide me for retrieving the same.

Azure DevOps
Accepted answer
  1. Durga Reshma Malthi 9,840 Reputation points Microsoft External Staff Moderator
    2025-08-08T09:54:37.7566667+00:00

    Hi Yash Tiwari

    Yes, you can use it using the below API:

    GET https://dev.azure.com/{organization}/{project}/_apis/wit/classificationnodes/areas?$depth=10&api-version=7.1-preview.2

    Using this API, you will get response like identifiers, so here you can treat them as root identifier and child identifier.

    vstfs:///Classification/Node/{rootIdentifier}:vstfs:///Classification/Node/{childIdentifier}

    Now you can call ACL API:

    GET https://dev.azure.com/{organization}/_apis/accesscontrollists/83e28ad4-2d72-4ceb-97b0-c7726d5502c3
    ?token=vstfs:///Classification/Node/6fa40c54-5847-4186-9f47-cb70c983285c:vstfs:///Classification/Node/4bb63716-9229-47ad-95c3-a9902c2b2a84
    &descriptors={descriptor}
    &includeExtendedInfo=true
    &inheritPermissions=true
    &api-version=7.1-preview.1

    Additional References:

    https://learn.microsoft.com/en-us/rest/api/azure/devops/wit/classification-nodes/get-classification-nodes?view=azure-devops-rest-7.1&tabs=HTTP

    https://learn.microsoft.com/en-us/rest/api/azure/devops/security/access-control-lists/query?view=azure-devops-rest-7.1&tabs=HTTP

    Hope this helps!

    Please Let me know if you have any queries.

    1 person found this answer helpful.
    0 comments

4 additional answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Durga Reshma Malthi 9,840 Reputation points Microsoft External Staff Moderator
    2025-08-06T13:29:08.1166667+00:00

    Hi Yash Tiwari

    There is no official documentation for this type.

    However, you can try the below steps:

    The token follows this pattern for Classification/Node:

    vstfs:///Classification/Node/{ParentNodeGUID}:{ChildNodeGUID}

    Here the ParentNodeGUID is typically the Project’s Classification Node ID and the ChildNodeGUID is the specific Area or Iteration Node ID.

    and this 83e28ad4-2d72-4ceb-97b0-c7726d5502c3 is the Security Namespace ID for Classification Nodes.

    You need to use the Classification Nodes API:

    To Get All Area Paths:

    GET https://dev.azure.com/{organization}/{project}/_apis/wit/classificationnodes/areas?$depth=10&api-version=7.1-preview.2

    Iteration Paths:

    GET https://dev.azure.com/{organization}/{project}/_apis/wit/classificationnodes/iterations?$depth=10&api-version=7.1-preview.2

    while executing this, you will get the identifiers that is ParentNodeGUID and ChildNodeGUID.

    Then you can construct the token - vstfs:///Classification/Node/{ParentNodeGUID}:{ChildNodeGUID}

    Then use this token in the ACL API:

    GET https://dev.azure.com/{organization}/_apis/accesscontrollists/83e28ad4-2d72-4ceb-97b0-c7726d5502c3?token=vstfs:///Classification/Node/{Parent}:{Child}&descriptors={descriptor}&includeExtendedInfo=true&inheritPermissions=true&api-version=7.1-preview.1

    Additional References:

    https://learn.microsoft.com/en-us/rest/api/azure/devops/security/access-control-lists?view=azure-devops-rest-7.1

    https://learn.microsoft.com/en-us/rest/api/azure/devops/graph/users?view=azure-devops-rest-7.1

    Hope this helps!

    Please Let me know if you have any queries.

    1 person found this answer helpful.
    0 comments
  2. Yash Tiwari 135 Reputation points
    2025-08-07T13:20:55.75+00:00

    Hi Durga,

    I checked the Rest API classificationnodes, by providing the depth as 10 for areas is giving me the all IDs for area path.

    0 comments
  3. Yash Tiwari 135 Reputation points
    2025-08-11T10:05:20.2033333+00:00

    Hi Durga,

    i checked the response and i got the token with the same

    0 comments
  4. Durga Reshma Malthi 9,840 Reputation points Microsoft External Staff Moderator
    2025-08-11T11:54:45.05+00:00

    Hi Yash Tiwari

    Are you seeing something like this:

    vstfs:///Classification/Node/{rootIdentifier}:vstfs:///Classification/Node/{childIdentifier}

    Run this - GET https://dev.azure.com/{org}/{project}/_apis/wit/classificationnodes/areas?$depth=10&api-version=7.1-preview.2

    Pick the token property from the area you care about and use it in the ACL API:

    GET https://dev.azure.com/{org}/_apis/accesscontrollists/83e28ad4-2d72-4ceb-97b0-c7726d5502c3
    ?token={tokenFromStep2}
    &descriptors={descriptor}
    &includeExtendedInfo=true
    &inheritPermissions=true
    &api-version=7.1-preview.1

    Hope this helps!

    Please Let me know if you have any queries.

    0 comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.