RBAC

9 endpoints

Manage custom roles and member assignments. Requires the RBAC app to be enabled for your organization.

roles.read

roles.write

environments.read

environments.write

Manage custom roles and member assignments. Requires the RBAC app to be enabled for your organization.

Authenticate with your organization API key. Include subOrgId as a query parameter or in the request body when using an org-wide key. Sub-org-scoped keys automatically target their sub-organization.

GET

/v1/rbac/roles

List system roles, custom roles, and member role assignments. Requires roles.read.

Query Parameters

Param	Type	Required	Description
subOrgId	string	No	Sub-organization ID. Required for org-wide keys on write operations; optional on list when the key is scoped to one sub-org.

Response — 200

{ "systemRoles": [ /* built-in roles */ ], "customRoles": [ /* custom role definitions */ ], "assignments": [ { "membershipId": "...", "roleId": "..." } ] }

POST

/v1/rbac/roles

Create a custom role with permissions. Requires roles.write.

Request Body

Param	Type	Required	Description
subOrgId	string	Yes	Sub-organization ID. Required for org-wide keys on write operations; optional on list when the key is scoped to one sub-org.
name	string	Yes	Role name
description	string	No	Role description
permissions	string[]	Yes	Array of OS permission IDs (e.g. members:read, audit:read)

Response — 200

{ "role": { /* role definition */ } }

GET

/v1/rbac/roles/{roleId}

Get a single custom role by ID. Requires roles.read.

Query Parameters

Param	Type	Required	Description
subOrgId	string	No	Sub-organization ID. Required for org-wide keys on write operations; optional on list when the key is scoped to one sub-org.

Response — 200

{ "role": { /* role definition */ } }

PATCH

/v1/rbac/roles/{roleId}

Update a custom role's name, description, or permissions. Requires roles.write.

Request Body

Param	Type	Required	Description
subOrgId	string	Yes	Sub-organization ID. Required for org-wide keys on write operations; optional on list when the key is scoped to one sub-org.
name	string	No	Role name
description	string	No	Role description
permissions	string[]	No	Array of OS permission IDs (e.g. members:read, audit:read)

Response — 200

{ "role": { /* updated role */ } }

DELETE

/v1/rbac/roles/{roleId}

Delete a custom role. Requires roles.write.

Query Parameters

Param	Type	Required	Description
subOrgId	string	No	Sub-organization ID. Required for org-wide keys on write operations; optional on list when the key is scoped to one sub-org.

Response — 200

{ "success": true }

GET

/v1/rbac/members/{membershipId}/roles

List custom role IDs assigned to an organization member. Requires roles.read.

Query Parameters

Param	Type	Required	Description
subOrgId	string	No	Sub-organization ID. Required for org-wide keys on write operations; optional on list when the key is scoped to one sub-org.

Response — 200

{ "roleIds": [ "role-id-1", "role-id-2" ] }

PUT

/v1/rbac/members/{membershipId}/roles

Replace custom role assignments for a member. Requires roles.write.

Request Body

Param	Type	Required	Description
subOrgId	string	Yes	Sub-organization ID. Required for org-wide keys on write operations; optional on list when the key is scoped to one sub-org.
roleIds	string[]	Yes	Array of custom role IDs to assign to the member

Response — 200

{ "success": true, "roleIds": [ /* assigned ids */ ] }

API key environments

GET

/v1/environments

List API key environments for a sub-organization. Requires environments.read.

Query Parameters

Param	Type	Required	Description
subOrgId	string	No	Sub-organization ID. Required for org-wide keys on write operations; optional on list when the key is scoped to one sub-org.

Response — 200

{ "environments": [ /* API key environments */ ] }

POST

/v1/environments

Create a custom API key environment. Requires environments.write.

Query Parameters

Param	Type	Required	Description
subOrgId	string	No	Sub-organization ID. Required for org-wide keys on write operations; optional on list when the key is scoped to one sub-org.

Request Body

Param	Type	Required	Description
name	string	Yes	Environment display name
slug	string	Yes	URL-safe slug (cannot be staging or production)
subOrgId	string	Yes	Sub-organization ID. Required for org-wide keys on write operations; optional on list when the key is scoped to one sub-org.

Response — 200

{ "environment": { /* created */ } }