---
title: "List roles"
method: GET
path: "/v1/roles"
tags: ["Roles"]
---

# List roles

`GET /v1/roles`

## Request

- Base URL: `https://api.subscriby.net`
- URL: `https://api.subscriby.net/v1/roles`
- Auth: HTTP bearer

```bash
curl https://api.subscriby.net/v1/roles \
  -H "Authorization: Bearer $SUBSCRIBY_TOKEN"
```

Every role across the teams the caller can see, with its permission codes. Visibility is the union of every team the caller owns or belongs to; a role from a team the caller cannot see answers `404 RESOURCE_NOT_FOUND` rather than `403`, so existence never leaks.

## Query parameters

- `page` integer
- `per_page` integer
- `sort_by` string
- `sort_direction` 'asc' | 'desc'

## Response `200`

Roles across every team the caller belongs to.

- object
  - `data` RoleResource[], required: The items on this page.
    - `id` string, required: The role's id.
    - `team_id` string, required: The team the role belongs to.
    - `code` string, required: The stable identifier permissions are addressed by, unique within the team and immutable after creation.
    - `name` string, nullable, required: The display name.
    - `description` string, nullable, required: What the role is for; null when none was given.
    - `owner_user_id` string, nullable, required: The user who created the role, the only one besides the team owner who may delete it.
    - `permissions` string[], required: The exact ability strings the role grants, the same strings used as token abilities, so roles can be matched against tokens without a second round-trip.
    - `created_at` string, nullable, required: When the role was created, ISO 8601.
  - `links` object, required: Links to the first, last, previous and next pages.
    - `first` string, nullable, required: The first page's URL.
    - `last` string, nullable, required: The last page's URL.
    - `prev` string, nullable, required: The previous page's URL; null on the first page.
    - `next` string, nullable, required: The next page's URL; null on the last page.
  - `meta` object, required: The paging counters for this page.
    - `current_page` integer, required: The page returned, 1-indexed.
    - `from` integer, nullable, required: The 1-indexed position of this page's first item across every page; null when the page is empty.
    - `last_page` integer, required: How many pages there are.
    - `links` object[], required: Generated paginator links.
      - `url` string, nullable, required: The page's URL; null for the ellipsis and the disabled arrows.
      - `label` string, required: The link's label: a page number, the previous or next arrow, or an ellipsis.
      - `active` boolean, required: Whether this link is the current page.
    - `path` string, nullable, required: Base path for paginator generated URLs.
    - `per_page` integer, required: Number of items shown per page.
    - `to` integer, nullable, required: Number of the last item in the slice.
    - `total` integer, required: Total number of items being paginated.

## Other responses

- `401`: `AUTHENTICATION_REQUIRED`: the request carries no bearer token, or one that is revoked, malformed, or minted for another environment (an `sbt_test_` token on production).
- `403`: `TOKEN_MISSING_ABILITY`: the token is valid but does not carry the ability this endpoint requires; `error.context.required_ability` names the one to grant. An endpoint that also checks who owns a row or which tier the account is on answers `FORBIDDEN`, `TEAM_TIER_REQUIRED` or `CONNECTOR_TIER_REQUIRED` with the same status, and says so in its own description.
- `429`: `RATE_LIMITED`: the token has spent its 300 requests a minute or 10,000 an hour; `Retry-After` says when the next one is accepted.

---

[API](https://skmtc.dev/memberpass/apis/subscriby-rest-api.md) · [All operations](https://skmtc.dev/memberpass/apis/subscriby-rest-api/llms.txt) · [OpenAPI document](https://skmtc.dev/memberpass/apis/subscriby-rest-api/revisions/59c4df91d764?raw)