List Roles
List every role defined in your active account, each with its full permission matrix. Roles are how you grant teammates scoped access — a role bundles a yes/no decision for each action on each resource, and you assign one role to each member.
The response also echoes the canonical list of resource keys (resources) so a UI can render one matrix row per resource without hard-coding the list.
Permission required
Requires roles:read. The account owner always passes — the owner holds every permission implicitly (an "all access" identity that is not represented as a role), so the owner can read, create, update and delete roles regardless of any matrix.
The permission matrix
Each role carries one permissions entry per resource. Every entry exposes four independent booleans — the verbs:
write means create.The resource keys are: endpoints, domains, certs, ips, firewall, rate_limits, traffic_inspector, members, roles, settings, billing.
Response (200 OK)
Role object
"Billing Admin").true for a built-in role shipped with the account. Built-in roles cannot be deleted. The account owner is separate from roles entirely — the owner is identified on the membership, not by a role.member_count > 0 cannot be deleted until those members are reassigned.resource, can_read, can_write, can_update, can_delete.Errors
roles:read.