Roles

RBAC roles and role-permission bindings (SSO-1891).

Base URL: https://api.stg.thoryn.org

Operations

Method	Path	Summary	Scopes
GET	/api/v1/roles	Roles List	tenant:roles.read
POST	/api/v1/roles	Roles Create	tenant:roles.write
GET	/api/v1/roles/{id}	Roles Get	tenant:roles.read
PATCH	/api/v1/roles/{id}	Roles Patch	tenant:roles.write
DELETE	/api/v1/roles/{id}	Roles Delete	tenant:roles.write
GET	/api/v1/roles/{id}/assignments	Roles List Assignments	tenant:roles.read
GET	/api/v1/roles/{id}/permissions	Roles List Permissions	tenant:roles.read
PUT	/api/v1/roles/{id}/permissions	Roles Set Permissions	tenant:roles.write

Operation details

GET /api/v1/roles

Roles List

• Operation ID: rolesList
• Required scopes: tenant:roles.read

Parameters:

Name	In	Required	Type	Description
limit	query	no	integer
cursor	query	no	string

Responses:

Status	Description	Body
200	OK	object
401	Unauthorized — bearer token missing, expired, signed by an untrusted issuer, or missing the tnt tenant claim.	Problem (problem+json)
403	Forbidden — token lacks a required tenant:* scope, or the tnt claim does not match the tenant addressed by the request path.	Problem (problem+json)

POST /api/v1/roles

Roles Create

• Operation ID: rolesCreate
• Required scopes: tenant:roles.write

Request body (required): application/json → CreateRoleRequest

Responses:

Status	Description	Body
200	OK	object
401	Unauthorized — bearer token missing, expired, signed by an untrusted issuer, or missing the tnt tenant claim.	Problem (problem+json)
403	Forbidden — token lacks a required tenant:* scope, or the tnt claim does not match the tenant addressed by the request path.	Problem (problem+json)

GET /api/v1/roles/{id}

Roles Get

• Operation ID: rolesGet
• Required scopes: tenant:roles.read

Parameters:

Name	In	Required	Type	Description
id	path	yes	string

Responses:

Status	Description	Body
200	OK	object
401	Unauthorized — bearer token missing, expired, signed by an untrusted issuer, or missing the tnt tenant claim.	Problem (problem+json)
403	Forbidden — token lacks a required tenant:* scope, or the tnt claim does not match the tenant addressed by the request path.	Problem (problem+json)

PATCH /api/v1/roles/{id}

Roles Patch

• Operation ID: rolesPatch
• Required scopes: tenant:roles.write

Parameters:

Name	In	Required	Type	Description
id	path	yes	string

Request body (required): application/json → UpdateRoleRequest

Responses:

Status	Description	Body
200	OK	object
401	Unauthorized — bearer token missing, expired, signed by an untrusted issuer, or missing the tnt tenant claim.	Problem (problem+json)
403	Forbidden — token lacks a required tenant:* scope, or the tnt claim does not match the tenant addressed by the request path.	Problem (problem+json)

DELETE /api/v1/roles/{id}

Roles Delete

• Operation ID: rolesDelete
• Required scopes: tenant:roles.write

Parameters:

Name	In	Required	Type	Description
id	path	yes	string

Responses:

Status	Description	Body
200	OK	object
401	Unauthorized — bearer token missing, expired, signed by an untrusted issuer, or missing the tnt tenant claim.	Problem (problem+json)
403	Forbidden — token lacks a required tenant:* scope, or the tnt claim does not match the tenant addressed by the request path.	Problem (problem+json)

GET /api/v1/roles/{id}/assignments

Roles List Assignments

• Operation ID: rolesListAssignments
• Required scopes: tenant:roles.read

Parameters:

Name	In	Required	Type	Description
id	path	yes	string
limit	query	no	integer
cursor	query	no	string

Responses:

Status	Description	Body
200	OK	object
401	Unauthorized — bearer token missing, expired, signed by an untrusted issuer, or missing the tnt tenant claim.	Problem (problem+json)
403	Forbidden — token lacks a required tenant:* scope, or the tnt claim does not match the tenant addressed by the request path.	Problem (problem+json)

GET /api/v1/roles/{id}/permissions

Roles List Permissions

• Operation ID: rolesListPermissions
• Required scopes: tenant:roles.read

Parameters:

Name	In	Required	Type	Description
id	path	yes	string
limit	query	no	integer
cursor	query	no	string

Responses:

Status	Description	Body
200	OK	object
401	Unauthorized — bearer token missing, expired, signed by an untrusted issuer, or missing the tnt tenant claim.	Problem (problem+json)
403	Forbidden — token lacks a required tenant:* scope, or the tnt claim does not match the tenant addressed by the request path.	Problem (problem+json)

PUT /api/v1/roles/{id}/permissions

Roles Set Permissions

• Operation ID: rolesSetPermissions
• Required scopes: tenant:roles.write

Parameters:

Name	In	Required	Type	Description
id	path	yes	string

Request body (required): application/json → SetRolePermissionsRequest

Responses:

Status	Description	Body
200	OK	object
401	Unauthorized — bearer token missing, expired, signed by an untrusted issuer, or missing the tnt tenant claim.	Problem (problem+json)
403	Forbidden — token lacks a required tenant:* scope, or the tnt claim does not match the tenant addressed by the request path.	Problem (problem+json)