RBAC

9 endpoints

Manage custom roles and member assignments. Requires the RBAC service to be enabled for your organization.

roles.read

roles.write

environments.read

environments.write

Manage custom roles and member assignments. Requires the RBAC service to be enabled for your organization.

Authenticate with your organization API key. Include subOrgId as a query parameter or in the request body when using an org-wide key. Organization-scoped keys automatically target their organization.

GET

/v1/rbac/roles

List system roles, custom roles, and member role assignments. Requires roles.read.

Query Parameters

Param	Type	Required	Description
subOrgId	string	No	Organization ID. Required for org-wide keys on write operations; optional on list when the key is scoped to one organization.

Response — 200

{ "systemRoles": [ /* account-team catalog (includes Owner) */ ], "directorySystemRoles": [ /* Admin, Member for directory users */ ], "customRoles": [ /* custom role definitions */ ], "assignments": [ { "scimUserId": "...", "roleId": "..." } ] }

POST

/v1/rbac/roles

Create a custom role with permissions. Requires roles.write.

Request Body

Param	Type	Required	Description
subOrgId	string	Yes	Organization ID. Required for org-wide keys on write operations; optional on list when the key is scoped to one organization.
name	string	Yes	Role name
description	string	No	Role description
permissions	string[]	Yes	Array of OS permission IDs (e.g. members:read, audit:read)

Response — 200

{ "role": { /* role definition */ } }

GET

/v1/rbac/roles/{roleId}

Get a single custom role by ID. Requires roles.read.

Query Parameters

Param	Type	Required	Description
subOrgId	string	No	Organization ID. Required for org-wide keys on write operations; optional on list when the key is scoped to one organization.

Response — 200

{ "role": { /* role definition */ } }

PATCH

/v1/rbac/roles/{roleId}

Update a custom role's name, description, or permissions. Requires roles.write.

Request Body

Param	Type	Required	Description
subOrgId	string	Yes	Organization ID. Required for org-wide keys on write operations; optional on list when the key is scoped to one organization.
name	string	No	Role name
description	string	No	Role description
permissions	string[]	No	Array of OS permission IDs (e.g. members:read, audit:read)

Response — 200

{ "role": { /* updated role */ } }

DELETE

/v1/rbac/roles/{roleId}

Delete a custom role. Requires roles.write.

Query Parameters

Param	Type	Required	Description
subOrgId	string	No	Organization ID. Required for org-wide keys on write operations; optional on list when the key is scoped to one organization.

Response — 200

{ "success": true }

GET

/v1/rbac/users/{userId}/roles

List custom role IDs assigned to an organization member. Requires roles.read.

Query Parameters

Param	Type	Required	Description
subOrgId	string	No	Organization ID. Required for org-wide keys on write operations; optional on list when the key is scoped to one organization.

Response — 200

{ "roleIds": [ "role-id-1", "role-id-2" ] }

PUT

/v1/rbac/users/{userId}/roles

Replace custom role assignments for a member. Requires roles.write.

Request Body

Param	Type	Required	Description
subOrgId	string	Yes	Organization ID. Required for org-wide keys on write operations; optional on list when the key is scoped to one organization.
roleIds	string[]	No	Array of custom role IDs to assign to the member
role	admin \| member \| null	No	Directory system role

Response — 200

{ "success": true, "roleIds": [ /* assigned ids */ ], "role": "admin" }

API key environments

GET

/v1/environments

List API key environments for an organization. Requires environments.read.

Query Parameters

Param	Type	Required	Description
subOrgId	string	No	Organization ID. Required for org-wide keys on write operations; optional on list when the key is scoped to one organization.

Response — 200

{ "environments": [ /* API key environments */ ] }

POST

/v1/environments

Create a custom API key environment. Requires environments.write.

Query Parameters

Param	Type	Required	Description
subOrgId	string	No	Organization ID. Required for org-wide keys on write operations; optional on list when the key is scoped to one organization.

Request Body

Param	Type	Required	Description
name	string	Yes	Environment display name
slug	string	Yes	URL-safe slug (cannot be staging or production)
subOrgId	string	Yes	Organization ID. Required for org-wide keys on write operations; optional on list when the key is scoped to one organization.

Response — 200

{ "environment": { /* created */ } }