---
title: "List the workspace's roles"
method: GET
path: "/w/{workspace}/workspaces/roles"
tags: ["workspace"]
---

# List the workspace's roles

`GET /w/{workspace}/workspaces/roles`

## Request

- Base URL: `/api` (relative, and the document was published on a file host, not at the API’s origin)
- URL: `/api/w/{workspace}/workspaces/roles`
- Auth: one of:
  - HTTP bearer
  - API key in cookie `token`

The roles members of this workspace can hold, as they apply here (instance definition with the workspace's override applied, then workspace-only roles), the stored overrides, and the caller's own role and capabilities.

## Path parameters

- `workspace` string, required

## Response `200`

workspace roles

- WorkspaceRoles
  - `roles` EffectiveRole[], required
    - `name` string, required
    - `label` string, required
    - `capabilities` RoleCapabilities, required
      - `code` boolean, required: Author scripts and run code of one's own (previews, dependency jobs, dynamic selects, resolving jobs, data table migrations). Required by `full` flows or apps.
      - `flows` 'none' | 'compose' | 'full', required: How much of a kind of runnable a role may author. `compose` assembles already-deployed runnables with no code of one's own.
      - `apps` 'none' | 'compose' | 'full', required: How much of a kind of runnable a role may author. `compose` assembles already-deployed runnables with no code of one's own.
      - `manage_schedules` boolean, required
      - `manage_triggers` boolean, required
      - `visibility` RoleVisibility, required: Pages a role sees. Not enforced.
        - `runs` boolean, required
        - `schedules` boolean, required
        - `resources` boolean, required
        - `variables` boolean, required
        - `assets` boolean, required
        - `triggers` boolean, required
        - `audit_logs` boolean, required
        - `groups` boolean, required
        - `folders` boolean, required
        - `workers` boolean, required
    - `source` 'instance' | 'workspace', required
    - `overridden` boolean, required
  - `overrides` RoleOverrides, required: A workspace's overrides keyed by role name; a name the instance does not define adds a workspace-only role (EE).
  - `custom_roles_enabled` boolean, required: Whether this workspace may add roles of its own.
  - `my_role` string, nullable
  - `my_capabilities` RoleCapabilities, required
    - `code` boolean, required: Author scripts and run code of one's own (previews, dependency jobs, dynamic selects, resolving jobs, data table migrations). Required by `full` flows or apps.
    - `flows` 'none' | 'compose' | 'full', required: How much of a kind of runnable a role may author. `compose` assembles already-deployed runnables with no code of one's own.
    - `apps` 'none' | 'compose' | 'full', required: How much of a kind of runnable a role may author. `compose` assembles already-deployed runnables with no code of one's own.
    - `manage_schedules` boolean, required
    - `manage_triggers` boolean, required
    - `visibility` RoleVisibility, required: Pages a role sees. Not enforced.
      - `runs` boolean, required
      - `schedules` boolean, required
      - `resources` boolean, required
      - `variables` boolean, required
      - `assets` boolean, required
      - `triggers` boolean, required
      - `audit_logs` boolean, required
      - `groups` boolean, required
      - `folders` boolean, required
      - `workers` boolean, required

## Changes

- **2026-10-21** `6ecbaacc13b1`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/windmill/apis/windmill-api/changes/w/:workspace/workspaces/roles/get.md)

---

[API](https://skmtc.dev/windmill/apis/windmill-api.md) · [All operations](https://skmtc.dev/windmill/apis/windmill-api/llms.txt) · [OpenAPI document](https://skmtc.dev/windmill/apis/windmill-api/revisions/c210165aa3db?raw)