Roles
/api/v1/permissionsRBAC §4.1 — the full permission catalog the role editor renders
from. Identical for every org; org_context is required only to gate
the route behind authentication + org membership.
Authorization
HTTPBearer In: header
Response Body
application/json
curl -X GET "https://example.com/api/v1/permissions"[ { "key": "string", "resource_type": "string", "action": "string", "description": "string", "is_owner_locked": true }]/api/v1/me/rolesRBAC §7, §9 — system roles, this org's custom roles, and any plan roles the org is currently entitled to.
Authorization
HTTPBearer In: header
Response Body
application/json
curl -X GET "https://example.com/api/v1/me/roles"[ { "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08", "org_id": "a40f5d1f-d889-42e9-94ea-b9b33585fc6b", "role_type_id": 0, "name": "string", "slug": "string", "description": "string", "is_editable": true, "cloned_from_role_id": "acff891a-9f56-4283-99d6-c6e0afc7780d", "plan_key": "string", "created_at": "2019-08-24T14:15:22Z", "updated_at": "2019-08-24T14:15:22Z" }]/api/v1/me/rolesRBAC §7 / ADR-0005 — create a custom role by cloning a global
system/plan role (base_role_id set) or from empty. Gated by
role:manage plus the custom_roles feature flag (ADR-0006).
Authorization
HTTPBearer In: header
Request Body
application/json
TypeScript Definitions
Use the request body type in TypeScript.
RBAC §7 — create a custom role. base_role_id set clones a global
system/plan role's permissions (ADR-0005); omitted, the role starts
empty. permission_keys are granted in addition to whatever the clone
contributes (or are the entire initial set, when created from empty).
Both are filtered through the no-escalation and owner-lock invariants
server-side — this schema does not itself enforce them.
Response Body
application/json
application/json
curl -X POST "https://example.com/api/v1/me/roles" \ -H "Content-Type: application/json" \ -d '{ "name": "string" }'{ "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08", "org_id": "a40f5d1f-d889-42e9-94ea-b9b33585fc6b", "role_type_id": 0, "name": "string", "slug": "string", "description": "string", "is_editable": true, "cloned_from_role_id": "acff891a-9f56-4283-99d6-c6e0afc7780d", "plan_key": "string", "created_at": "2019-08-24T14:15:22Z", "updated_at": "2019-08-24T14:15:22Z"}/api/v1/me/roles/{role_id}/permissionsRBAC §9 — a single role's granted permissions.
Authorization
HTTPBearer In: header
Path Parameters
uuidResponse Body
application/json
application/json
curl -X GET "https://example.com/api/v1/me/roles/497f6eca-6276-4993-bfeb-53cbbbba6f08/permissions"[ { "key": "string", "resource_type": "string", "action": "string", "description": "string", "is_owner_locked": true }]/api/v1/me/roles/{role_id}/permissionsRBAC §6.3 invariants 2, 3, 4 — replace a custom role's permission set wholesale.
Authorization
HTTPBearer In: header
Path Parameters
uuidRequest Body
application/json
TypeScript Definitions
Use the request body type in TypeScript.
RBAC §6.3 — replace a custom role's permission set wholesale.
Response Body
application/json
application/json
curl -X PUT "https://example.com/api/v1/me/roles/497f6eca-6276-4993-bfeb-53cbbbba6f08/permissions" \ -H "Content-Type: application/json" \ -d '{}'{ "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08", "org_id": "a40f5d1f-d889-42e9-94ea-b9b33585fc6b", "role_type_id": 0, "name": "string", "slug": "string", "description": "string", "is_editable": true, "cloned_from_role_id": "acff891a-9f56-4283-99d6-c6e0afc7780d", "plan_key": "string", "created_at": "2019-08-24T14:15:22Z", "updated_at": "2019-08-24T14:15:22Z"}