---
title: "List group role assignments"
method: GET
path: "/zones/{zoneId}/groups/{groupId}/roles"
tags: ["Groups"]
---

# List group role assignments

`GET /zones/{zoneId}/groups/{groupId}/roles`

Returns the roles assigned to the group. Members inherit these roles. Returns the shared role-assignment shape with `principal_type` set to `group`. Use cursor pagination via `after`/`before`; pass `expand[]=total_count` to include the matching row count. Pass `filter[id]` (repeatable, max 100) to restrict results to a known set of role assignments, mutually exclusive with `after`/`before` (returns 400 if combined). When `filter[id]` is set, `limit` is ignored and the response contains every requested assignment that exists on the group, in a single page. IDs not on the group are silently omitted.

## Path parameters

- `zoneId` string, required
- `groupId` string, required

## Query parameters

- `after` string
- `before` string
- `limit` integer
- `expand[]` union
  - 'total_count'
  - string[]
- `filter[id]` union
  - string — Restrict results to the role assignment with this ID. Repeatable, max 100. Mutually exclusive with after/before.
  - string[]

## Response `200`

Default Response

- object
  - `items` IamRoleAssignment[], required
    - `id` string, required — Unique identifier of the role assignment
    - `zone_id` string, required — Zone this assignment belongs to
    - `principal_type` string, required — The kind of principal the role is assigned to: `user`, `application`, or `group`. A role assigned to a `group` is inherited by that group's members.
    - `principal_id` string, required — ID of the principal the role is assigned to (a user, application, or group ID).
    - `role_id` string, required — ID of the assigned role
    - `role_identifier` string, required — Role identifier: a lowercase slug (letters and digits separated by single hyphens or underscores), unique per owner type within a zone. Role identifiers surface in policy evaluation, so the slug restriction keeps them unambiguous in policy text.
    - `role_owner_type` 'platform' | 'customer', required — Owner type of the assigned role. Disambiguates roles that share an identifier across owner types.
    - `scope_type` string, nullable — The kind of resource this grant is scoped to (e.g. `zone`). Null when the assignment is unscoped (applies to the owning zone itself).
    - `scope_id` string, nullable — The ID of the scoped resource. Null when the assignment is unscoped.
    - `created_at` string, date-time, required — Entity creation timestamp
    - `updated_at` string, date-time, required — Entity update timestamp
  - `pagination` IamPagination, required — Cursor-based pagination metadata
    - `after_cursor` string, required — An opaque cursor used for paginating through a list of results
    - `before_cursor` string, required — An opaque cursor used for paginating through a list of results
    - `total_count` integer — Total number of items matching the query. Only included when expand[]=total_count is requested.

## Other responses

- `404` — Error response
- `default` — Error response

## Changes

- **2026-08-26** `d65d51379d93` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/keycardai/apis/untitled-api/changes/zones/:zoneId/groups/:groupId/roles/get.md)

---

[API](https://skmtc.dev/keycardai/apis/untitled-api.md) · [All operations](https://skmtc.dev/keycardai/apis/untitled-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/keycardai/untitled-api/revisions/d65d51379d93/schema)