---
title: "Get Predefined Roles"
method: GET
path: "/v3/roles"
tags: ["Roles"]
---

# Get Predefined Roles

`GET /v3/roles`

Retrieves the predefined, or system managed, roles.

## Response `200`

The predefined, or system managed, roles.

- object
  - `control_planes` object
    - `name` 'Control Planes', required
    - `roles` object, required
      - `admin` object
        - `name` 'Admin', required
        - `description` 'This role grants full write access to all entities within a control plane.', required
      - `certificate_admin` object
        - `name` 'Certificate Admin', required
        - `description` 'This role grants full write access to administer certificates.', required
      - `consumer_admin` object
        - `name` 'Consumer Admin', required
        - `description` 'This role grants full write access to administer consumers.', required — This role grants full write access to administer Consumers. Can configure plugins and view plugin partials for Consumers they have access to. Cannot create or modify global plugins or plugins outside their scope.
      - `creator` object
        - `name` 'Creator', required
        - `description` 'Creates a new Control Plane in an organization. The creator becomes the owner of the Control Plane they create.', required
      - `debug_session_creator` object
        - `name` 'Debug Session Creator', required
        - `description` 'This role grants access to create debug sessions. This role also grants read-only access to all entities within a control plane.', required
      - `deployer` object
        - `name` 'Deployer', required
        - `description` 'This role grants full write access to administer services, routes and plugins necessary to deploy services in Service Hub.', required
      - `gateway_service_admin` object
        - `name` 'Gateway Service Admin', required
        - `description` 'This role grants full write access to administer gateway services.', required — This role grants full write access to administer Gateway Services. Can configure plugins and view plugin partials for Services they have access to. Cannot create or modify global plugins or plugins outside their scope.
      - `plugin_admin` object
        - `name` 'Plugin Admin', required
        - `description` 'This role grants full write access to administer plugins.', required — Can configure plugins at any scope (global, Service, Route, or Consumer) within a Control Plane Group. Also has write access to plugin partials.
      - `route_admin` object
        - `name` 'Route Admin', required
        - `description` 'This role grants full write access to administer routes.', required — This role grants full write access to administer Routes. Can configure plugins and view plugin partials for Routes they have access to. Cannot create or modify global plugins or plugins outside their scope.
      - `sni_admin` object
        - `name` 'SNI Admin', required
        - `description` 'This role grants full write access to administer SNIs.', required
      - `upstream_admin` object
        - `name` 'Upstream Admin', required
        - `description` 'This role grants full write access to administer upstreams.', required
      - `viewer` object
        - `name` 'Viewer', required
        - `description` 'This role grants read only access to all entities within a control plane.', required — This role grants read-only access to all the configurations of a Control Plane Group and corresponding Data Plane nodes. Includes read-only access to plugin partials within accessible scopes.
  - `api_products` object
    - `name` 'API Products', required
    - `roles` object, required
      - `admin` object
        - `name` 'Admin', required
        - `description` 'This role grants full write access to an API product and its versions.', required
      - `application_registration` object
        - `name` 'Application Registration', required
        - `description` 'This role grants permission to enable and disable application registration on an API product.', required
      - `creator` object
        - `name` 'Creator', required
        - `description` 'This access is required to create API products. This access is not for creating sub-entities such as versions, API specs, etc.', required
      - `deployer` object
        - `name` 'Deployer', required
        - `description` 'This role grants permission to deploy and remove an API product from a control plane.', required
      - `maintainer` object
        - `name` 'Maintainer', required
        - `description` 'This role grants all write permission to manage an API product and to administer plugins.', required
      - `plugins_admin` object
        - `name` 'Plugins Admin', required
        - `description` 'This role grants full write permission to administer plugins.', required
      - `publisher` object
        - `name` 'Publisher', required
        - `description` 'This role grants permission to publish an API product to one or more portals.', required
      - `viewer` object
        - `name` 'Viewer', required
        - `description` 'Viewer has read-only access to an API product and its sub-entities.', required
  - `audit_logs` object
    - `name` 'Audit Logs', required
    - `roles` object, required
      - `admin` object
        - `name` 'Admin', required
        - `description` 'This role grants full write access to the Audit log configuration.', required
  - `identity` object
    - `name` 'Identity', required
    - `roles` object, required
      - `admin` object
        - `name` 'Admin', required
        - `description` 'This role grants full write access to the Identity configuration.', required
  - `mesh_control_planes` object
    - `name` 'Mesh Control Plane', required
    - `roles` object, required
      - `admin` object
        - `name` 'Admin', required
        - `description` 'This role grants full write access to the related to Mesh control planes.', required
      - `connector` object
        - `name` 'Connector', required
        - `description` 'This role grants a mesh zone to connect to the mesh control plane in Konnect.', required
      - `creator` object
        - `name` 'Creator', required
        - `description` 'This role grants access to create new Mesh control planes.', required
      - `viewer` object
        - `name` 'Viewer', required
        - `description` 'This role grants access to read-only permissions to Mesh control planes.', required
  - `dashboards` object
    - `name` 'Dashboards', required
    - `roles` object, required
      - `admin` object
        - `name` 'Admin', required
        - `description` 'Allows users to edit, delete, and share a Dashboard in Konnect Analytics.', required
      - `creator` object
        - `name` 'Creator', required
        - `description` 'Allows users to create a new Dashboard in Konnect Analytics.', required
      - `editor` object
        - `name` 'Editor', required
        - `description` 'Allows users to edit a Dashboard in Konnect Analytics.', required
      - `viewer` object
        - `name` 'Viewer', required
        - `description` 'Allows users to view any Dashboards content in Konnect Analytics.', required
  - `reports` object
    - `name` 'Reports', required
    - `roles` object, required
      - `admin` object
        - `name` 'Admin', required
        - `description` 'Allows users to edit, delete, and share a Report in Konnect Analytics.', required
      - `creator` object
        - `name` 'Creator', required
        - `description` 'Allows users to create a new Report in Konnect Analytics.', required
      - `editor` object
        - `name` 'Editor', required
        - `description` 'Allows users to edit a Report in Konnect Analytics.', required
      - `viewer` object
        - `name` 'Viewer', required
        - `description` 'Allows users to view a Report in Konnect Analytics.', required

## Other responses

- `400` — Bad Request
- `401` — Unauthenticated

---

[API](https://skmtc.net/kong/apis/konnect-api-go-sdk.md) · [All operations](https://skmtc.net/kong/apis/konnect-api-go-sdk/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/kong/konnect-api-go-sdk/versions/f920f418f552/schema)