---
title: "List available roles"
method: GET
path: "/organizations/{organization_id}/roles"
tags: ["Roles"]
---

# List available roles

`GET /organizations/{organization_id}/roles`

Returns the list of available roles in the system for the organization.
This includes both organization-level roles (e.g., org_admin, org_member) and
zone-level roles (e.g., zone_manager, zone_viewer).

Each role includes:
- `name`: Internal identifier (e.g., org_admin, zone_manager)
- `label`: Human-readable display name (e.g., Organization Administrator)
- `scope`: Whether the role applies at organization or zone level

## Path parameters

- `organization_id` string, required — Organization ID or label identifier

## Query parameters

- `scope` 'organization' | 'zone' — The scope at which a role can be assigned. - organization: Roles that apply at the organization level (e.g., org_admin) - zone: Roles that apply at the zone level (e.g., zone_manager)
- `expand[]` string[]

## Headers

- `X-Client-Request-ID` string, uuid

## Response `200`

List of available roles

- OrgManagementRolesList — List of available roles
  - `items` OrgManagementRole[], required — List of roles
    - `name` string, required — Internal identifier for the role (e.g., org_admin, zone_manager)
    - `label` string, required — Human-readable display name for the role
    - `description` string, required — Detailed description of the role and its permissions
    - `scope` 'organization' | 'zone', required — The scope at which a role can be assigned. - organization: Roles that apply at the organization level (e.g., org_admin) - zone: Roles that apply at the zone level (e.g., zone_manager)
  - `permissions` OrgManagementPermissions — Permissions granted to the authenticated principal for this resource. Only populated when the 'expand[]=permissions' query parameter is provided. Keys are resource types (e.g., "organizations"), values are objects mapping permission names to boolean values indicating if the permission is granted.

## Other responses

- `400` — bad request error response when caller supplied invalid input data
- `401` — unauthorized error response when caller session is not authenticated
- `403` — forbidden error response when caller does not have permissions to a resource
- `404` — not found error response when caller does not have permission to see a resource or the resource does not exist
- `429` — rate limit exceeded error response when caller has exhausted api limits for the given time period
- `500` — internal server error response when server encountered error of its own creation
- `503` — service unavailable error when server you're attempting to reach is not available
- `default` — internal server error response when server encountered error of its own creation

---

[API](https://skmtc.net/keycardai/apis/untitled-api.md) · [All operations](https://skmtc.net/keycardai/apis/untitled-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/keycardai/untitled-api/revisions/2f5033ed4491/schema)