権限 (Permissions)
認可されたアプリケーションは、既定ではユーザーの基本情報 (Basic Information) にしかアクセスできません。さらに追加の情報へアクセスするには、追加の権限を取得する必要があります。
追加の権限が必要なとき、それを得ずにユーザー情報へアクセスした場合には、HTTPステータスの200とともに
{"data":[]}
のような空のデータ、または
{"error":"(#200) The user hasn't authorized the application to perform this action"}
のようなレスポンスが返されます。
権限の取得
アプリケーションの認可ページへのアクセス時に、scopeパラメータで必要な権限の種類を指定します。権限はカンマ区切りで複数指定できます。
https://www.facebook.com/dialog/oauth
?client_id=APP_ID
&redirect_uri=REDIRECT_URL
&scope=COMMA_SEPARATED_LIST_OF_PERMISSION_NAMES
追加の権限はOAuth Dialogで、赤枠部分のように表示されます。
取得済みの権限の確認
次のURLへリクエストを送ることで、取得済みの権限の一覧を取得できます。
https://graph.facebook.com/me/permissions
?access_token=USER_ACCESS_TOKEN
レスポンスは、
{"data":[{"installed":1,"user_status":1}]}
のような形式で返されます。
App Settingsによる権限の確認
ユーザーはApp Settingsで、アプリケーションに許可した権限を確認できます。
アプリケーション名の右にある[Edit]をクリックすると表示される、「This app needs」の一覧がそれです。
権限の種類
User Permissions / Friends Permissions
| 権限※1 | 認められるアクセス |
|---|---|
| _about_me | the "About Me" section of the profile in the about property |
| _activities | the user's list of activities as the activities connection |
| _birthday | the birthday with year as the birthday property |
| _checkins | Provides read access to the authorized user's check-ins or a friend's check-ins that the user can see.
This permission is superseded by user_status for new applications as of March, 2012. |
| _education_history | education history as the education property |
| _events | the list of events the user is attending as the events connection |
| _groups | the list of groups the user is a member of as the groups connection |
| _hometown | the user's hometown in the hometown property |
| _interests | the user's list of interests as the interests connection |
| _likes | the list of all of the pages the user has liked as the likes connection |
| _location | the user's current location as the location property |
| _notes | the user's notes as the notes connection |
| _photos | ユーザーがアップロードした写真、およびユーザーがタグ付けした写真。 |
| _questions | the questions the user or friend has asked |
| _relationships | the user's family and personal relationships and relationship status |
| _relationship_details | the user's relationship preferences |
| _religion_politics | the user's religious and political affiliations |
| _status | ユーザーのステータス メッセージとチェックイン。
(投稿に関連付けられた位置情報に、この権限がどのように作用するかはlocation_postを参照のこと) |
| _subscriptions | the user's subscribers and subscribees |
| _videos | the videos the user has uploaded, and videos the user has been tagged in |
| _website | the user's web site URL |
| _work_history | work history as the work property |
| the user's primary email address in the email property.
Do not spam users. Your use of email must comply both with Facebook policies and with the CAN-SPAM Act. |
※1 権限の正確な表記は、User permissionsはuser_xx、Friends permissionはfriends_xxの形式となります。ただしemailだけはemailの表記で、user permissionsのみで有効です。
Extended Permissions
| 権限 | 説明 |
|---|---|
| read_friendlists | Provides access to any friend lists the user created. All user's friends are provided as part of basic data, this extended permission grants access to the lists of friends a user has created, and should only be requested if your application utilizes lists of friends. |
| read_insights | Provides read access to the Insights data for pages, applications, and domains the user owns. |
| read_mailbox | Provides the ability to read from a user's Facebook Inbox. |
| read_requests | Provides read access to the user's friend requests |
| read_stream | ユーザーのニュース フィードのすべての投稿への、アクセスと検索を許可する。 |
| xmpp_login | Provides applications that integrate with Facebook Chat the ability to log in users. |
| ads_management | Provides the ability to manage ads and call the Facebook Ads API on behalf of a user. |
| create_event | Enables your application to create and modify events on the user's behalf |
| manage_friendlists | Enables your app to create and edit the user's friend lists. |
| manage_notifications | Enables your app to read notifications and mark them as read. Intended usage: This permission should be used to let users read and act on their notifications; it should not be used to for the purposes of modeling user behavior or data mining. Apps that misuse this permission may be banned from requesting it. |
| user_online_presence | Provides access to the user's online/offline presence |
| friends_online_presence | Provides access to the user's friend's online/offline presence |
| publish_checkins | Enables your app to perform checkins on behalf of the user. |
| publish_stream | アプリケーションがコンテントやコメント、それに「いいね！」を、ユーザーやユーザーの友人のストリームに投稿することを許可する。
これはpublish_actionsも含む権限の上位セットである。 However, please note that Facebook recommends a user-initiated sharing model. Please read the Platform Policies to ensure you understand how to properly use this permission. Note, you do not need to request the publish_stream permission in order to use the Feed Dialog, the Requests Dialog or the Send Dialog. |
| rsvp_event | Enables your application to RSVP to events on the user's behalf |
Open Graph Permissions
| 権限※1 | 説明 |
|---|---|
| publish_actions | Allows your app to publish to the Open Graph using Built-in Actions, Achievements, Scores, or Custom Actions. Your app can also publish other activity which is detailed in the Publishing Permissions doc. Note: The user-prompt for this permission will be displayed in the first screen of the Enhanced Auth Dialog and cannot be revoked as part of the authentication flow. However, a user can later revoke this permission in their Account Settings. If you want to be notified if this happens, you should subscribe to the permissions object within the Realtime API. |
| _actions.music | Allows you to retrieve the actions published by all applications using the built-in music.listens action. |
| _actions.news | Allows you to retrieve the actions published by all applications using the built-in news.reads action. |
| _actions.video | Allows you to retrieve the actions published by all applications using the built-in video.watches action. |
| _actions:APP_NAMESPACE | Allows you retrieve the actions published by another application as specified by the app namespace. For example, to request the ability to retrieve the actions published by an app which has the namespace awesomeapp, prompt the user for the users_actions:awesomeapp and/or friends_actions:awesomeapp permissions. |
| _games_activity | Allows you post and retrieve game achievement activity. |
※1 権限の正確な表記は、User permissionsはuser_xx、Friends permissionはfriends_xxの形式となります。ただしpublish_actionsだけはpublish_actionsの表記で、user permissionsのみで有効です。