--- title: "List RBAC Role Permissions" method: GET path: "/v1/organizations/rbac_roles/{rbac_role_id}/permissions" --- # List RBAC Role Permissions `GET /v1/organizations/rbac_roles/{rbac_role_id}/permissions` ## Request - Base URL: `https://api.anthropic.com` - URL: `https://api.anthropic.com/v1/organizations/rbac_roles/{rbac_role_id}/permissions` - Auth: none declared List the permissions an RBAC Role grants. The RBAC Roles API is available to Claude Enterprise organizations only. ## Path parameters - `rbac_role_id` string, required: ID of the RBAC Role. ## Query parameters - `limit` integer: Number of items to return per page. Defaults to `20`. Ranges from `1` to `1000`. - `page` string, nullable: Optionally set to the `next_page` token from the previous response. ## Headers - `anthropic-version` string: The version of the Claude API you want to use. Read more about versioning and our version history [here](https://platform.claude.com/docs/en/api/versioning). ## Response `200` Successful Response - RbacRolePermissionList - `data` RbacRolePermission[], required - `action` string, required: Action the permission grants on the resource. The vocabulary follows the resource: an `organization` grant carries a product-feature entitlement (for example `chat`), an admin-panel permission entitlement (`permission_*`), or a blanket capability-access mode — `capability_access_all` grants every product-feature entitlement except `inference_hooks_inspection`, which a role holds only through its own row, and `capability_access_all_ga` grants the subset of those for stable features as it stands at permission-check time; neither mode grants model-access entitlements. A consumer enumerating a role's per-feature grants should treat a blanket row as granting every product-feature entitlement it covers, or it will under-report the role's effective access. A `connector_tool` grant carries a tool-access action (`use` or `always_allow`); a `connector_scope` grant carries the scope action `grant` (the role may receive the named OAuth scope when tokens are minted for the connector); `connector` and `all_connectors` grants carry a tool-access action, the scope action, or an authentication-method action (`interactive` or `managed`). - `resource` union, required: What the permission applies to. A tagged union: `type` names the kind of resource and determines which identifier fields are present. - OrganizationPermissionResource - `organization_id` string, required: UUID of the organization the permission applies to. - `type` 'organization', required: Kind of resource the permission applies to. - ConnectorToolPermissionResource - `connector_id` string, required: ID of the connector the permission applies to. - `tool_name` string, required: Published name of the connector tool the permission applies to. When the published name contains characters outside `[a-zA-Z0-9_-]` (or collides with a reserved form), it is server-encoded into a stable `{prefix}_{32-hex}` form — a shortened readable prefix of the name plus a hash — from which the published name is not recoverable. - `type` 'connector_tool', required: Kind of resource the permission applies to. - ConnectorScopePermissionResource - `connector_id` string, required: ID of the connector the permission applies to. - `scope` string, required: OAuth scope the permission names — the role may receive this scope when tokens are minted for the connector. Subject to the same encoding rule as `tool_name`: a scope containing characters outside `[a-zA-Z0-9_-]` (or colliding with a reserved form) appears server-encoded in a stable `{prefix}_{32-hex}` form. OAuth scopes routinely contain `:` and `/`, so most appear encoded. - `type` 'connector_scope', required: Kind of resource the permission applies to. - ConnectorPermissionResource - `connector_id` string, required: ID of the connector the permission applies to. - `type` 'connector', required: Kind of resource the permission applies to. - AllConnectorsPermissionResource - `type` 'all_connectors', required: Kind of resource the permission applies to. - `type` 'rbac_role_permission', required: Object type. For RBAC Role Permissions, this is always `"rbac_role_permission"`. - `has_more` boolean, required: Indicates whether there are more results beyond this page. - `next_page` string, nullable, required: Opaque cursor for the next page. Pass as the `page` parameter on the next request. ## Other responses - `400`: Invalid argument - The client specified an invalid argument - `401`: Unauthenticated - The request does not have valid authentication credentials - `403`: Permission denied - The caller does not have permission to execute the specified operation - `404`: Not found - Some requested entity was not found - `408`: Deadline exceeded - The deadline expired before the operation could complete - `409`: Aborted - The operation was aborted due to concurrency issue - `412`: Failed precondition - Operation was rejected because the system is not in required state - `413`: Out of range - Operation was attempted past the valid range - `429`: Resource exhausted - Some resource has been exhausted (rate limiting) - `431`: Request header fields too large - Request metadata was too large - `499`: Cancelled - The operation was cancelled by the client - `500`: Internal - Internal server error - `501`: Unimplemented - The operation is not implemented or supported - `503`: Unavailable - The service is currently unavailable - `504`: Deadline exceeded - Upstream service did not respond in time - `529`: Overloaded - The service is temporarily overloaded ## Changes - **2026-10-30** `9e51fecd6e7f`: 1 info - endpoint added [Operation history](https://skmtc.dev/anthropics/apis/anthropic-api/changes/v1/organizations/rbac_roles/:rbac_role_id/permissions/get.md) --- [API](https://skmtc.dev/anthropics/apis/anthropic-api.md) - [All operations](https://skmtc.dev/anthropics/apis/anthropic-api/llms.txt) - [OpenAPI document](https://skmtc.dev/anthropics/apis/anthropic-api/revisions/328591af84ad?raw)