403 on /_api/web/webs if I don't have access to 1 subsite out of many

Question

I have a REST call to mysite/_api/web/webs, I get a successful response, but if i remove permission from mysite/subsite01/ I get a 403, even if I have access to mysite/subsite02/ mysite/subsite03/. I am making the call from a publishing page on /mysite/ so I am confused as to why this would be the case, surely it should return the list of subsites, but just not include subsite01

Answer 1

/_api/web/webs only works for users who have manage web or above permissions on the site collection i.e you need to be either a site collection owner or Site collection admin for this endpoint to work.

If you try with a visitor or member permission, it wont work. Its a common issue.

To get around it, you need to use /_api/web/getsubwebsfilteredforcurrentuser(nwebtemplatefilter=-1,nconfigurationfilter=0) endpoint and make a GET request. It will give you permission trimmed list of sites you have access to.

Reference - Webs REST API reference