---
title: "List"
method: GET
path: "/admin/roles"
tags: ["roles"]
---

# List

`GET /admin/roles`

## Request

- Base URL: `https://api.instruxi.dev/api/v1/enforcer`
- URL: `https://api.instruxi.dev/api/v1/enforcer/admin/roles`
- Auth: one of:
  - API key in header `Authorization`
  - API key in header `X-API-Key`

Every role in the catalog, built-in and custom — roles are a global table with no tenant_id, so this is not tenant-scoped. Gated on tenant_read or above; see also listRoles (GET /roles), the same underlying data exposed to ANY authenticated caller with no admin gate, for populating a role picker. total counts the roles matching q; an unknown sort falls back to slug.

## Query parameters

- `q` string
- `sort` 'slug' | 'name' | 'created' | 'updated'
- `sort_dir` 'asc' | 'desc'
- `limit` integer
- `offset` integer

## Response `200`

OK

- InternalDeliveryHttpHandlerRolePageResponse
  - `data` EnforcerV3InternalDomainRoleRole[]
    - `admin_managed` boolean
    - `created_at` string
    - `cross_tenant` boolean: Capability grants (additive; all false = baseline-only, like "user").
    - `description` string
    - `id` string
    - `mpp_ops` boolean: MPPOps: read-only MPP deposit-intent operator views (migration 000129).
    - `name` string
    - `slug` string
    - `tenant_manage` boolean
    - `tenant_read` boolean
    - `tenant_write` boolean
    - `updated_at` string
  - `limit` integer
  - `offset` integer
  - `success` boolean
  - `total` integer

## Other responses

- `400`: Bad Request
- `401`: Unauthorized
- `403`: Forbidden
- `500`: Internal Server Error

---

[API](https://skmtc.dev/instruxi/apis/enforcer-api.md) · [All operations](https://skmtc.dev/instruxi/apis/enforcer-api/llms.txt) · [OpenAPI document](https://skmtc.dev/instruxi/apis/enforcer-api/revisions/fa82bc1becc0?raw)