#hub-sites 3 articles

• /_api/hubsites is trimmed per user — a lookup that walks the hubs finds your app for the page editor and not for the readergotchas / rest-apiGET /_api/hubsites returned 2 hubs to an admin and 1 to an ordinary user who had Full Control on the missing hub's site, so client code that discovers something by walking the hub list works for the editor and silently…
• /_api/HubSites returns an empty list (HTTP 200) when the caller cannot see the hub sitesgotchas / rest-apiThe hub list is security-trimmed, so an account that cannot read the hub sites gets value: [] with HTTP 200; "this site has no hub" and "no inherited owner" must never be derived from it — read IsHubSite/HubSiteId from…
• JoinHubSite silently moves a site that already belongs to another hubgotchas / rest-apiCalling JoinHubSite on a site that sits in hub A returns 200 and the site is in hub B at once — no unjoin step, no warning, so any "apply hub" plan must read the current hub first