---
title: "List user role assignments"
method: GET
path: "/zones/{zoneId}/users/{userId}/roles"
tags: ["Zone Roles"]
---

# List user role assignments

`GET /zones/{zoneId}/users/{userId}/roles`

## Request

- Base URL: `https://docs.keycard.ai` (the document declares no server; this is the origin it was published from)
- URL: `https://docs.keycard.ai/zones/{zoneId}/users/{userId}/roles`
- Auth: one of:
  - HTTP bearer
  - OAuth 2
    - Client credentials
    - Token URL: `/service-account-token`

Returns the roles assigned to the specified user within the zone. Use cursor pagination via `after`/`before`; pass `expand[]=total_count` to include the matching row count. Pass `filter[scope_id]` (repeatable, max 100) to keep only the assignments scoped to those targets, and `filter[scoped]=false` to keep only unscoped assignments (the ones applying to the zone itself), so a known set of targets resolves in a fixed number of requests.

## Path parameters

- `zoneId` string, required
- `userId` string, required

## Query parameters

- `after` string
- `before` string
- `limit` integer
- `expand[]` union
  - 'total_count'
  - string[]
- `filter[scope_id]` union
  - string: Restrict results to assignments scoped to this target ID (e.g. a zone ID). Repeatable, max 100; values are OR'd. Unscoped assignments never match.
  - string[]
- `filter[scoped]` boolean

## Response `200`

Default Response

- object
  - `items` IamRoleAssignment[], required
    - `id` string, required: Unique identifier of the role assignment
    - `zone_id` string, required: Zone this assignment belongs to
    - `principal_type` string, required: The kind of principal the role is assigned to: `user`, `application`, or `group`. A role assigned to a `group` is inherited by that group's members.
    - `principal_id` string, required: ID of the principal the role is assigned to (a user, application, or group ID).
    - `role_id` string, required: ID of the assigned role
    - `role_identifier` string, required: Role identifier: a lowercase slug (letters and digits separated by single hyphens or underscores), unique per owner type within a zone. Role identifiers surface in policy evaluation, so the slug restriction keeps them unambiguous in policy text.
    - `role_owner_type` 'platform' | 'customer', required: Owner type of the assigned role. Disambiguates roles that share an identifier across owner types.
    - `scope_type` string, nullable: The kind of resource this grant is scoped to (e.g. `zone`). Null when the assignment is unscoped (applies to the owning zone itself).
    - `scope_id` string, nullable: The ID of the scoped resource. Null when the assignment is unscoped.
    - `created_at` string, date-time, required: Entity creation timestamp
    - `updated_at` string, date-time, required: Entity update timestamp
  - `pagination` IamPagination, required: Cursor-based pagination metadata
    - `after_cursor` string, required: An opaque cursor used for paginating through a list of results
    - `before_cursor` string, required: An opaque cursor used for paginating through a list of results
    - `total_count` integer: Total number of items matching the query. Only included when expand[]=total_count is requested.

## Other responses

- `404`: Error response
- `default`: Error response

## Changes

- **2026-10-29** `0dee67e0a73a`: 2 info
  - added the new optional `query` request parameter `filter[scope_id]`
  - added the new optional `query` request parameter `filter[scoped]`
- **2026-08-26** `d65d51379d93`: 3 info
  - added the non-success response with the status `404`
  - the `items/items/role_identifier` response's property pattern `^[a-z0-9]+(?:[-_][a-z0-9]+)*$` was added for the status `200`
  - added the required property `items/items/role_owner_type` to the response with the `200` status
- **2026-06-09** `7e0e4fa2e16f`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/keycardai/apis/keycard-ai-keycard-api/changes/zones/:zoneId/users/:userId/roles/get.md)

---

[API](https://skmtc.dev/keycardai/apis/keycard-ai-keycard-api.md) - [All operations](https://skmtc.dev/keycardai/apis/keycard-ai-keycard-api/llms.txt) - [OpenAPI document](https://skmtc.dev/keycardai/apis/keycard-ai-keycard-api/revisions/0dee67e0a73a?raw)