> ## Documentation Index > Fetch the complete documentation index at: https://docs.lerian.studio/llms.txt > Use this file to discover all available pages before exploring further. # List Roles > Returns your organization's roles, one page at a time. A role is a named bundle of permissions. It is what you grant to a group (or, less commonly, straight to a person); the permissions inside it are what the holder may then do. Called whenever the role list is shown, and after any create or delete to refresh it. The filters are relational, not text matching: `userId` narrows to the roles that user holds and `groupId` to the roles granted to that group, which is how you answer "what does this person have?" without walking every role. `name` is the substring match. Read-only: nothing changes. Failures: - `400 IDE-0018` — `limit` is above the deployment's maximum (100 by default). - `400 IDE-0019` — `page` is below 1. - `503 IDE-0066` — the identity provider is unavailable (unreachable, too slow to answer, or failing). Nothing about the request was wrong; retry it later. ## OpenAPI ````yaml /en/openapi/v3-current/AM-identity.yaml get /v1/roles openapi: 3.1.0 info: contact: name: Lerian Studio url: https://lerian.studio description: OpenAPI 3.1 surface for the Access Manager identity component. license: name: Lerian Studio General License title: Plugin Access Manager — Identity API version: v1 servers: - url: https://identity.sandbox.lerian.net security: [] tags: - description: >- M2M-only: each plugin declares its own permissions, roles and M2M contract, and the server reconciles them. name: Declarations - description: >- A tenant administrator's customers. Each partner holds what its credentials may DO (permissions, per product) and WHERE they may do it (scope, per product and dimension); an M2M application attached to one is confined to that intersection. Administrator-only: authorized on the "partners" resource, and every route resolves the owning organization from the caller's token. name: Partners paths: /v1/roles: get: tags: - Roles summary: List Roles description: >- Returns your organization's roles, one page at a time. A role is a named bundle of permissions. It is what you grant to a group (or, less commonly, straight to a person); the permissions inside it are what the holder may then do. Called whenever the role list is shown, and after any create or delete to refresh it. The filters are relational, not text matching: `userId` narrows to the roles that user holds and `groupId` to the roles granted to that group, which is how you answer "what does this person have?" without walking every role. `name` is the substring match. Read-only: nothing changes. Failures: - `400 IDE-0018` — `limit` is above the deployment's maximum (100 by default). - `400 IDE-0019` — `page` is below 1. - `503 IDE-0066` — the identity provider is unavailable (unreachable, too slow to answer, or failing). Nothing about the request was wrong; retry it later. operationId: listRoles parameters: - description: Page number. explode: false in: query name: page schema: default: 1 description: Page number. examples: - 1 format: int64 type: integer - description: Items per page. explode: false in: query name: limit schema: default: 10 description: Items per page. examples: - 10 format: int64 type: integer - description: Filter by name (case-insensitive substring). explode: false in: query name: name schema: description: Filter by name (case-insensitive substring). type: string - description: 'Filter by user ID (relational listing): only roles the user holds.' explode: false in: query name: userId schema: description: 'Filter by user ID (relational listing): only roles the user holds.' type: string - description: >- Filter by group ID (relational listing): only roles granted to the group. explode: false in: query name: groupId schema: description: >- Filter by group ID (relational listing): only roles granted to the group. type: string responses: '200': content: application/json: schema: $ref: '#/components/schemas/RolePagination' description: OK '400': content: application/json: schema: $ref: '#/components/schemas/HTTPError' description: Bad Request '404': content: application/json: schema: $ref: '#/components/schemas/HTTPError' description: Not Found '422': content: application/problem+json: schema: $ref: '#/components/schemas/Detail' description: Unprocessable Entity '500': content: application/json: schema: $ref: '#/components/schemas/HTTPError' description: Internal Server Error '503': content: application/json: schema: $ref: '#/components/schemas/HTTPError' description: Service Unavailable security: - BearerAuth: [] components: schemas: RolePagination: additionalProperties: false properties: items: description: The page of roles. items: $ref: '#/components/schemas/RoleResponse' type: array limit: description: The page size that was applied. examples: - 10 format: int64 type: integer page: description: The 1-based page this response corresponds to. examples: - 1 format: int64 type: integer total: description: Total number of roles, across all pages. examples: - 10 format: int64 type: integer type: object HTTPError: additionalProperties: false properties: code: type: string entityType: type: string err: {} message: type: string title: type: string type: object Detail: additionalProperties: true properties: code: description: >- Stable, machine-readable domain error code scoped to the emitting service (format: -NNNN). type: string detail: description: >- A human-readable explanation specific to this occurrence of the problem. examples: - Property foo is required but is missing. type: string errors: description: Optional list of individual error details items: $ref: '#/components/schemas/ErrorDetail' type: - array - 'null' instance: description: >- A URI reference that identifies the specific occurrence of the problem. examples: - https://example.com/error-log/abc123 format: uri type: string status: description: HTTP status code examples: - 400 format: int64 type: integer title: description: >- A short, human-readable summary of the problem type. This value should not change between occurrences of the error. examples: - Bad Request type: string type: default: about:blank description: A URI reference to human-readable documentation for the error. examples: - https://example.com/errors/example format: uri type: string upstream: $ref: '#/components/schemas/Upstream' description: >- RFC 9457 extension member: the error a proxied third-party provider reported. Absent unless the emitting service explicitly surfaced one. type: object RoleResponse: additionalProperties: false properties: createdAt: examples: - '2026-06-24T10:00:00Z' type: string description: examples: - A custom editor role type: string groups: items: type: string type: array id: examples: - custom-editor type: string isEnabled: examples: - true type: boolean isSystem: examples: - false type: boolean name: examples: - Custom Editor type: string roles: items: type: string type: array users: items: type: string type: array type: object ErrorDetail: additionalProperties: false properties: location: description: >- Where the error occurred, e.g. 'body.items[3].tags' or 'path.thing-id' type: string message: description: Error message text type: string value: description: The value at the given location type: object Upstream: additionalProperties: false properties: code: description: The upstream provider's own error code, verbatim. examples: - E4001 type: string message: description: >- The upstream provider's own error message, verbatim (bounded, never its raw response body). examples: - account not found at provider type: string type: object securitySchemes: BearerAuth: bearerFormat: JWT description: JWT bearer token issued by the identity provider. scheme: bearer type: http ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.