---
title: "List group role assignments by scope"
method: GET
path: "/zones/{zoneId}/groups/{groupId}/role-assignments"
tags: ["Groups"]
---

# List group role assignments by scope

`GET /zones/{zoneId}/groups/{groupId}/role-assignments`

## Request

- Base URL: `https://docs.keycard.ai` (the document declares no server; this is the origin it was published from)
- URL: `https://docs.keycard.ai/zones/{zoneId}/groups/{groupId}/role-assignments`
- Auth: one of:
  - HTTP bearer
  - OAuth 2
    - Client credentials
    - Token URL: `/service-account-token`

Returns the group's role assignments keyed by the scopes named in the request: one group per `scope_id[]` value (empty when the group holds nothing on it) plus, with `unscoped=true`, the group of assignments applying to the zone itself. Not paginated — the response has exactly as many groups as the request named, so a known set of up to 100 targets always resolves in one request. Use `GET …/roles` to enumerate everything the group holds.

## Path parameters

- `zoneId` string, required
- `groupId` string, required

## Query parameters

- `scope_type` string
- `scope_id[]` string[]
- `unscoped` boolean

## Response `200`

Role assignments keyed by requested scope. Not paginated: the number of groups equals the number of scopes named in the request.

- IamRoleAssignmentScopeGroupList: Role assignments keyed by requested scope. Not paginated: the number of groups equals the number of scopes named in the request.
  - `items` IamRoleAssignmentScopeGroup[], required: One group per requested scope, in request order (the unscoped group first when `unscoped=true`).
    - `scope_type` string, nullable, required: The requested `scope_type` this group answers for. `null` for the unscoped group (grants that apply to the zone itself).
    - `scope_id` string, nullable, required: The requested scope ID this group answers for. `null` for the unscoped group.
    - `assignments` IamRoleAssignment[], required: Every role assignment the principal holds on this scope; empty when it holds none.
      - `id` string, required: Unique identifier of the role assignment
      - `zone_id` string, required: Zone this assignment belongs to
      - `principal_type` string, required: The kind of principal the role is assigned to: `user`, `application`, or `group`. A role assigned to a `group` is inherited by that group's members.
      - `principal_id` string, required: ID of the principal the role is assigned to (a user, application, or group ID).
      - `role_id` string, required: ID of the assigned role
      - `role_identifier` string, required: Role identifier: a lowercase slug (letters and digits separated by single hyphens or underscores), unique per owner type within a zone. Role identifiers surface in policy evaluation, so the slug restriction keeps them unambiguous in policy text.
      - `role_owner_type` 'platform' | 'customer', required: Owner type of the assigned role. Disambiguates roles that share an identifier across owner types.
      - `scope_type` string, nullable: The kind of resource this grant is scoped to (e.g. `zone`). Null when the assignment is unscoped (applies to the owning zone itself).
      - `scope_id` string, nullable: The ID of the scoped resource. Null when the assignment is unscoped.
      - `created_at` string, date-time, required: Entity creation timestamp
      - `updated_at` string, date-time, required: Entity update timestamp

## Other responses

- `404`: Error response
- `default`: Error response

## Changes

- **2026-10-29** `0dee67e0a73a`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/keycardai/apis/untitled-api/changes/zones/:zoneId/groups/:groupId/role-assignments/get.md)

---

[API](https://skmtc.dev/keycardai/apis/untitled-api.md) - [All operations](https://skmtc.dev/keycardai/apis/untitled-api/llms.txt) - [OpenAPI document](https://skmtc.dev/keycardai/apis/untitled-api/revisions/0dee67e0a73a?raw)