List Roles

GET /v1/account/roles

List every role defined in your active account, each with its full permission matrix. Roles are how you grant teammates scoped access — a role bundles a yes/no decision for each action on each resource, and you assign one role to each member.

The response also echoes the canonical list of resource keys (resources) so a UI can render one matrix row per resource without hard-coding the list.

Permission required

Requires roles:read. The account owner always passes — the owner holds every permission implicitly (an "all access" identity that is not represented as a role), so the owner can read, create, update and delete roles regardless of any matrix.

The permission matrix

Each role carries one permissions entry per resource. Every entry exposes four independent booleans — the verbs:

can_read read
View / list the resource.
can_write write (create)
Create new instances of the resource. write means create.
can_update update
Modify existing instances.
can_delete delete
Remove instances.

The resource keys are: endpoints, domains, certs, ips, firewall, rate_limits, traffic_inspector, members, roles, settings, billing.

Response (200 OK)

roles array
All roles in the active account, ordered by name. Each element is a role object (below).
resources string[]
The canonical, ordered list of resource keys the matrix can address. Use it to render the role editor.

Role object

id int64
Role identifier. Pass this when assigning the role to a member or inviting someone.
name string
Display name (e.g. "Billing Admin").
description string
Optional free-text description. Omitted when not set.
is_builtin bool
true for a built-in role shipped with the account. Built-in roles cannot be deleted. The account owner is separate from roles entirely — the owner is identified on the membership, not by a role.
member_count int
Number of active members currently assigned this role. A role with member_count > 0 cannot be deleted until those members are reassigned.
permissions array
The matrix — one entry per resource with resource, can_read, can_write, can_update, can_delete.

Errors

401 Unauthorized
Missing or invalid auth.
403 Forbidden
No active account, or your role lacks roles:read.
500
Failed to load roles.
Request
curl "https://api.ngris.com/v1/account/roles" \ -H "X-API-KEY: <your_api_key>"
Python
from ngris import Ngris client = Ngris(api_key="<your_api_key>") roles = client.account.list_roles() for role in roles["roles"]: print(role["name"], role["member_count"])
Response — 200 OK
{ "roles": [ { "id": 12, "name": "Billing Admin", "description": "Manage billing only", "is_builtin": false, "member_count": 2, "permissions": [ { "resource": "billing", "can_read": true, "can_write": true, "can_update": true, "can_delete": false }, { "resource": "endpoints", "can_read": true, "can_write": false, "can_update": false, "can_delete": false } ] } ], "resources": [ "endpoints", "domains", "certs", "ips", "firewall", "rate_limits", "traffic_inspector", "members", "roles", "settings", "billing" ] }
On this page
List Roles
Iris