---
title: "List all roles for a tenant"
method: GET
path: "/roles"
tags: ["Role"]
---

# List all roles for a tenant

`GET /roles`

Returns every role belonging to the tenant identified by the required `tenant-id` header. Use this to populate role-selection UIs or to audit which roles exist before assigning one to a user. Requires the `tenant-id` header; the request returns 400 if the header is absent or blank. The response is a paginated envelope containing a `data` array of role objects, a `totalCount`, and `links` for navigation.

## Headers

- `tenant-id` string

## Response `200`

Roles retrieved successfully

- RoleListResponseDto — Paginated list of roles
  - `data` RoleResponseDto[] — List of roles
    - `id` string — Role ID
    - `name` string — Role name
    - `tenantId` string — Tenant ID
    - `description` string — Role description
    - `createdAt` string, date-time
    - `updatedAt` string, date-time
    - `createdBy` string — ID of the user who created the role
    - `updatedBy` string — ID of the user who last updated the role
  - `totalCount` integer — Total number of roles
  - `links` PageLinks — HATEOAS-style pagination links.
    - `self` string — Link to the current page.
    - `next` string — Link to the next page; null on the last page.
    - `prev` string — Link to the previous page; null on the first page.

## Other responses

- `400` — Bad request - Invalid request parameters or missing required headers
- `401` — Authentication required - Valid authentication token is missing or invalid
- `403` — Forbidden - User does not have the required permissions to read roles
- `500` — Internal server error - Failed to retrieve roles. The response body is a flat `{"error": "..."}` object, not the structured ApiError shape used elsewhere.

---

[API](https://skmtc.net/certifyos/apis/certify-api-layer.md) · [All operations](https://skmtc.net/certifyos/apis/certify-api-layer/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/certifyos/certify-api-layer/revisions/563848e0ecc0/schema)