---
title: "List Transitive Role Members"
method: GET
path: "/management/v1/role/{role_id}/members/transitive"
tags: ["role"]
---

# List Transitive Role Members

`GET /management/v1/role/{role_id}/members/transitive`

## Request

- Base URL: `https://localhost`
- URL: `https://localhost/management/v1/role/{role_id}/members/transitive`
- Auth: HTTP bearer
- TypeScript: <https://skmtc.dev/lakekeeper/apis/lakekeeper-management-api/docs/management/v1/role/:role_id/members/transitive/get.ts> (a function with typed inputs; its response is checked against the schema)

Lists the role's transitive members — users assigned to the role or any role
in its downward membership closure, plus every role in that closure — as one
keyset-paginated page, optionally filtered to one kind. Supported only when
assignments are catalog-managed; an assignment-managing authorizer (e.g.
OpenFGA) returns `501`.

## Path parameters

- `role_id` string, uuid, required

## Query parameters

- `type` 'user' | 'role': Kind of a role member. Serializes as `"user"` / `"role"`.
- `pageToken` string, nullable
- `pageSize` integer, nullable

## Headers

- `x-project-id` string, nullable

## Response `200`

Transitive members of the role

- ListRoleMembersResponse: One page of a role's members (users ∪ member roles) — direct for `/members`, transitive for `/members/transitive`.
  - `members` RoleMember[], required
    - union: A member of a role, returned by `GET /role/{id}/members`. Discriminated by `type`: a `user` (direct user→role assignment) or a `role` (role→role edge). Identity is hydrated; for requests and add confirmations use the un-hydrated [`RoleMemberRef`] instead.
      - object: A user assigned to the role.
        - `email` string, nullable: Email; `null` if unknown.
        - `id` string, required: `IdP` subject id of the user.
        - `name` string, nullable: Display name; `null` when the user has no name.
        - `user-type` 'human' | 'application': Type of a User
        - `type` 'user', required
      - object: Another role that is a member of the role.
        - `id` string, uuid, required
        - `ident` string, required
        - `name` string, required
        - `type` 'role', required
  - `next-page-token` string, nullable: Token for the next page; `null`/absent once the listing is exhausted. Note for SDK authors: **stop when `next-page-token` is null/absent.** The final page of results may itself return a null token, so don't rely on receiving a separate trailing empty page — keep requesting until the token is null.

## Other responses

- `501`: Transitive listing is not supported under the configured authorizer backend
- `4XX`

---

[API](https://skmtc.dev/lakekeeper/apis/lakekeeper-management-api.md) - [All operations](https://skmtc.dev/lakekeeper/apis/lakekeeper-management-api/llms.txt) - [OpenAPI document](https://skmtc.dev/lakekeeper/apis/lakekeeper-management-api/revisions/c5cb9a12a98c?raw)