---
title: "Get all roles."
method: GET
path: "/access-control/roles"
tags: ["access_control", "enterprise"]
---

# Get all roles.

`GET /access-control/roles`

Gets all existing roles. The response contains all global and organization local roles, for the organization which user is signed in.

You need to have a permission with action `roles:read` and scope `roles:*`.

The `delegatable` flag reduces the set of roles to only those for which the signed-in user has permissions to assign.

## Query parameters

- `delegatable` boolean
- `includeHidden` boolean
- `targetOrgId` integer

## Response `200`

(empty)

- RoleDTO[]
  - `created` string, date-time, required
  - `delegatable` boolean
  - `description` string, required
  - `displayName` string, required
  - `global` boolean
  - `group` string, required
  - `hidden` boolean
  - `mapped` boolean
  - `name` string, required
  - `permissions` Permission[]
    - `action` string
    - `created` string, date-time
    - `scope` string
    - `updated` string, date-time
  - `uid` string, required
  - `updated` string, date-time, required
  - `version` integer, required

## Other responses

- `403` — ForbiddenError is returned if the user/token has insufficient permissions to access the requested resource.
- `500` — InternalServerError is a general error indicating something went wrong internally.

---

[API](https://skmtc.net/grafana/apis/http-api.md) · [All operations](https://skmtc.net/grafana/apis/http-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/grafana/http-api/versions/df55ba1718ba/schema)