---
title: "Every colleague with their roles + modules"
method: GET
path: "/api/company-roles/assignments"
tags: ["Company Roles"]
---

# Every colleague with their roles + modules

`GET /api/company-roles/assignments`

The roster behind the "Atribuir" screen — one call, never one per user.

Reusing an existing endpoint was not possible: `GET /api/users` returns no
role or module data and is gated on `modulo.utilizadores` (this screen is
`modulo.configuracoes`, so an admin holding only Configurações would lose it),
`GET /company-roles` returns `holders` as a COUNT rather than a roster, and
`GET /company-roles/users/{id}` is the per-user read this exists to replace.

⚠️ **Privacy note (deliberate widening, flagged in review):** this exposes the
staff roster — names and emails — on a `modulo.configuracoes` route, where
today the same list needs `modulo.utilizadores`. It is `admin`-gated and
tenant-scoped, and an admin can already reach the same names through
`GET /company-roles` holders, but it is a genuine widening of who sees it.

## Query parameters

- `include_inactive` boolean

## Headers

- `x-api-token` string, nullable

## Response `200`

Successful Response

- unknown

## Other responses

- `422` — Validation Error

---

[API](https://skmtc.dev/multigest/apis/multigest-protected-api.md) · [All operations](https://skmtc.dev/multigest/apis/multigest-protected-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/multigest/multigest-protected-api/revisions/4b44eb76b3ee/schema)