List the permissions a custom role may hold

The space-level permission strings a custom role can be built from, grouped by resource. api_key_grantable mirrors GET /api/api-keys/available-scopes; requires_one_of names the reads a role holding the permission must also hold.

GET/api/roles/vocabulary

Authorization

better-auth.session_token<token>

Cookie session from Better Auth. Requires X-Org-Id header for org-scoped routes.

In: cookie

Header Parameters

X-Org-Id?string

Organization ID. Required for cookie auth. Not needed for API key auth (org resolved from key).

Formatuuid

curl -X GET "https://your-instance/api/roles/vocabulary"

{
  "object": "list",
  "data": [
    {
      "resource": "string",
      "permissions": [
        {
          "permission": "string",
          "action": "string",
          "api_key_grantable": true,
          "requires_one_of": [
            "string"
          ]
        }
      ]
    }
  ],
  "hasMore": true
}

{
  "type": "https://docs.appstrate.dev/errors/unauthorized",
  "title": "Unauthorized",
  "status": 401,
  "detail": "Invalid or missing session",
  "code": "unauthorized",
  "request_id": "req_abc123"
}

{
  "type": "https://docs.appstrate.dev/errors/forbidden",
  "title": "Forbidden",
  "status": 403,
  "detail": "Insufficient permissions",
  "code": "forbidden",
  "request_id": "req_abc123"
}