List roles and the capabilities attached to each

GET

/auth/roles

• Local development behind nginx (port 8088 by default)

Includes parent_id but does NOT recurse — each role’s capabilities array is just the direct attachments. Effective capabilities for a user (role chain + grants - revokes) are exposed via /auth/me/capabilities.

Authorizations

• cookieAuth
• bearerAuth

Responses

200

List of roles

Array<object>

object

id

required

string format: uuid

name

required

string

description

required

string

parent_id

Single-inheritance parent role; null for root roles.

string format: uuid

nullable

capabilities

required

Capability codes attached directly to this role. Does NOT include inherited capabilities — chase parent_id to get the full set, or call /auth/me/capabilities for the resolved view of the current user.

Array<string>

401

Authentication required, missing, or invalid

object

error

required

Human-readable error summary

string

Example

the request could not be completed

Example

{
  "error": "authentication required: sign in and retry with a valid session or API token"
}

403

Authenticated but missing required capabilities

object

error

required

Human-readable error summary

string

Example

the request could not be completed