# Roles

## List

`client.Zones.Groups.Roles.List(ctx, groupID, params) (*ZoneGroupRoleListResponse, error)`

**get** `/zones/{zoneId}/groups/{groupId}/roles`

Returns the roles assigned to the group. Members inherit these roles. Returns the shared role-assignment shape with `principal_type` set to `group`. Use cursor pagination via `after`/`before`; pass `expand[]=total_count` to include the matching row count. Pass `filter[id]` (repeatable, max 100) to restrict results to a known set of role assignments, mutually exclusive with `after`/`before` (returns 400 if combined). When `filter[id]` is set, `limit` is ignored and the response contains every requested assignment that exists on the group, in a single page. IDs not on the group are silently omitted.

### Parameters

- `groupID string`

- `params ZoneGroupRoleListParams`

  - `ZoneID param.Field[string]`

    Path param: Zone ID

  - `After param.Field[string]`

    Query param: Cursor for forward pagination

  - `Before param.Field[string]`

    Query param: Cursor for backward pagination

  - `Expand param.Field[ZoneGroupRoleListParamsExpandUnion]`

    Query param

    - `type ZoneGroupRoleListParamsExpandString string`

      - `const ZoneGroupRoleListParamsExpandStringTotalCount ZoneGroupRoleListParamsExpandString = "total_count"`

    - `type ZoneGroupRoleListParamsExpandArray []string`

      - `const ZoneGroupRoleListParamsExpandArrayItemTotalCount ZoneGroupRoleListParamsExpandArrayItem = "total_count"`

  - `FilterID param.Field[ZoneGroupRoleListParamsFilterIDUnion]`

    Query param: Restrict results to the role assignment with this ID. Repeatable, max 100. Mutually exclusive with after/before.

    - `string`

    - `type ZoneGroupRoleListParamsFilterIDArray []string`

  - `Limit param.Field[int64]`

    Query param: Maximum number of items to return

### Returns

- `type ZoneGroupRoleListResponse struct{…}`

  - `Items []RoleAssignment`

    - `ID string`

      Unique identifier of the role assignment

    - `CreatedAt Time`

      Entity creation timestamp

    - `PrincipalID string`

      ID of the principal the role is assigned to (a user, application, or group ID).

    - `PrincipalType string`

      The kind of principal the role is assigned to: `user`, `application`, or `group`. A role assigned to a `group` is inherited by that group's members.

    - `RoleID string`

      ID of the assigned role

    - `RoleIdentifier string`

      Role identifier: a lowercase slug (letters and digits separated by single hyphens or underscores), unique per owner type within a zone. Role identifiers surface in policy evaluation, so the slug restriction keeps them unambiguous in policy text.

    - `RoleOwnerType RoleAssignmentRoleOwnerType`

      Owner type of the assigned role. Disambiguates roles that share an identifier across owner types.

      - `const RoleAssignmentRoleOwnerTypePlatform RoleAssignmentRoleOwnerType = "platform"`

      - `const RoleAssignmentRoleOwnerTypeCustomer RoleAssignmentRoleOwnerType = "customer"`

    - `UpdatedAt Time`

      Entity update timestamp

    - `ZoneID string`

      Zone this assignment belongs to

    - `ScopeID string`

      The ID of the scoped resource. Null when the assignment is unscoped.

    - `ScopeType string`

      The kind of resource this grant is scoped to (e.g. `zone`). Null when the assignment is unscoped (applies to the owning zone itself).

  - `Pagination ZoneGroupRoleListResponsePagination`

    Cursor-based pagination metadata

    - `AfterCursor string`

      An opaque cursor used for paginating through a list of results

    - `BeforeCursor string`

      An opaque cursor used for paginating through a list of results

    - `TotalCount int64`

      Total number of items matching the query. Only included when expand[]=total_count is requested.

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/keycardai/keycard-go"
  "github.com/keycardai/keycard-go/option"
)

func main() {
  client := keycard.NewClient(
    option.WithAPIKey("My API Key"),
  )
  roles, err := client.Zones.Groups.Roles.List(
    context.TODO(),
    "groupId",
    keycard.ZoneGroupRoleListParams{
      ZoneID: "zoneId",
    },
  )
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", roles.Items)
}
```

## Add

`client.Zones.Groups.Roles.Add(ctx, groupID, params) (*RoleAssignment, error)`

**post** `/zones/{zoneId}/groups/{groupId}/roles`

Assigns a role to the group; members inherit it. Provide role_id, or role_identifier with owner_type. Returns the shared role-assignment shape with `principal_type` set to `group`.

### Parameters

- `groupID string`

- `params ZoneGroupRoleAddParams`

  - `ZoneID param.Field[string]`

    Path param: Zone ID

  - `RoleAssignmentCreate param.Field[RoleAssignmentCreate]`

    Body param: Schema for assigning a role to a principal. Provide exactly one of role_id or role_identifier. When role_identifier is used, owner_type is required to disambiguate roles that share an identifier across owner types; owner_type must be omitted when role_id is used.

### Returns

- `type RoleAssignment struct{…}`

  Represents a role assigned to a principal within a zone

  - `ID string`

    Unique identifier of the role assignment

  - `CreatedAt Time`

    Entity creation timestamp

  - `PrincipalID string`

    ID of the principal the role is assigned to (a user, application, or group ID).

  - `PrincipalType string`

    The kind of principal the role is assigned to: `user`, `application`, or `group`. A role assigned to a `group` is inherited by that group's members.

  - `RoleID string`

    ID of the assigned role

  - `RoleIdentifier string`

    Role identifier: a lowercase slug (letters and digits separated by single hyphens or underscores), unique per owner type within a zone. Role identifiers surface in policy evaluation, so the slug restriction keeps them unambiguous in policy text.

  - `RoleOwnerType RoleAssignmentRoleOwnerType`

    Owner type of the assigned role. Disambiguates roles that share an identifier across owner types.

    - `const RoleAssignmentRoleOwnerTypePlatform RoleAssignmentRoleOwnerType = "platform"`

    - `const RoleAssignmentRoleOwnerTypeCustomer RoleAssignmentRoleOwnerType = "customer"`

  - `UpdatedAt Time`

    Entity update timestamp

  - `ZoneID string`

    Zone this assignment belongs to

  - `ScopeID string`

    The ID of the scoped resource. Null when the assignment is unscoped.

  - `ScopeType string`

    The kind of resource this grant is scoped to (e.g. `zone`). Null when the assignment is unscoped (applies to the owning zone itself).

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/keycardai/keycard-go"
  "github.com/keycardai/keycard-go/option"
)

func main() {
  client := keycard.NewClient(
    option.WithAPIKey("My API Key"),
  )
  roleAssignment, err := client.Zones.Groups.Roles.Add(
    context.TODO(),
    "groupId",
    keycard.ZoneGroupRoleAddParams{
      ZoneID: "zoneId",
    },
  )
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", roleAssignment.ID)
}
```

## Remove

`client.Zones.Groups.Roles.Remove(ctx, roleID, params) error`

**delete** `/zones/{zoneId}/groups/{groupId}/roles/{roleId}`

Revokes a role from the group. Provide the same (scope_type, scope_id) pair the grant was created with, or omit both to revoke the unscoped grant.

### Parameters

- `roleID string`

- `params ZoneGroupRoleRemoveParams`

  - `ZoneID param.Field[string]`

    Path param: Zone ID

  - `GroupID param.Field[string]`

    Path param: Group ID

  - `ScopeID param.Field[string]`

    Query param: Scope target of the grant to revoke. Provide together with scope_type.

  - `ScopeType param.Field[string]`

    Query param: Scope kind of the grant to revoke. Provide together with scope_id.

### Example

```go
package main

import (
  "context"

  "github.com/keycardai/keycard-go"
  "github.com/keycardai/keycard-go/option"
)

func main() {
  client := keycard.NewClient(
    option.WithAPIKey("My API Key"),
  )
  err := client.Zones.Groups.Roles.Remove(
    context.TODO(),
    "roleId",
    keycard.ZoneGroupRoleRemoveParams{
      ZoneID: "zoneId",
      GroupID: "groupId",
    },
  )
  if err != nil {
    panic(err.Error())
  }
}
```