List Roles
List every role defined in your active account, each with its full permission matrix. Roles are how you grant teammates scoped access — a role bundles a yes/no decision for each action on each resource, and you assign one role to each member.
The response also echoes the canonical list of resource keys (resources) so a UI can render one matrix row per resource without hard-coding the list.
Permission required
Requires roles:read. The account owner always passes — the owner holds every permission implicitly (an "all access" identity that is not represented as a role), so the owner can read, create, update and delete roles regardless of any matrix.
Query parameters
page is sent. Default 15, capped at 200.The permission matrix
Each role carries one permissions entry per resource. Every entry exposes four independent booleans — the verbs:
write means create.The resource keys are: endpoints, domains, certs, ips, firewall, rate_limits, traffic_inspector, members, roles, settings, billing.
Response (200 OK)
0 when page was not sent (the whole list).Role object
role_uuid when assigning the role to a member or inviting someone.uuid of the account the role belongs to."Billing Admin").true for a built-in role shipped with the account. Built-in roles cannot be deleted. The account owner is separate from roles entirely — the owner is identified on the membership, not by a role.member_count > 0 cannot be deleted until those members are reassigned.role_uuid, resource, can_read, can_write, can_update, can_delete.Deprecated: until the sunset each role also carries the legacy integer id and account_id, and each permission row its integer id and role_id. Don't use them; read uuid and the *_uuid fields.
Errors
roles:read.