Skip to content
Docs
Roles
List

List application role assignments

API Reference
Zones
Applications
Roles

List application role assignments

client.zones.applications.roles.list(stringapplicationID, RoleListParams { zoneId, after, before, 2 more } params, RequestOptionsoptions?): RoleListResponse { items, pagination }
GET/zones/{zoneId}/applications/{applicationId}/roles

Returns the roles assigned to the specified application within the zone. The full result set is currently returned in a single page; the after/before/limit cursor parameters are reserved and not yet enforced, and pagination cursors are always null.

ParametersExpand Collapse
applicationID: string
params: RoleListParams { zoneId, after, before, 2 more }
zoneId: string

Path param: Zone ID

after?: string

Query param: Cursor for forward pagination

minLength1
maxLength255
before?: string

Query param: Cursor for backward pagination

minLength1
maxLength255
expand?: "total_count" | Array<"total_count">

Query param

Accepts one of the following:
"total_count"
"total_count"
Array<"total_count">
"total_count"
limit?: number

Query param: Maximum number of items to return

minimum1
maximum100
ReturnsExpand Collapse
RoleListResponse { items, pagination }
items: Array<RoleAssignment { id, created_at, principal_id, 8 more } >
id: string

Unique identifier of the role assignment

created_at: string

Entity creation timestamp

formatdate-time
principal_id: string

ID of the principal the role is assigned to (a user, application, or group ID).

principal_type: string

The kind of principal the role is assigned to: user, application, or group. A role assigned to a group is inherited by that group's members.

role_id: string

ID of the assigned role

role_identifier: string

Role identifier: a lowercase slug (letters and digits separated by single hyphens or underscores), unique per owner type within a zone. Role identifiers surface in policy evaluation, so the slug restriction keeps them unambiguous in policy text.

minLength1
maxLength255
role_owner_type: "platform" | "customer"

Owner type of the assigned role. Disambiguates roles that share an identifier across owner types.

Accepts one of the following:
"platform"
"customer"
updated_at: string

Entity update timestamp

formatdate-time
zone_id: string

Zone this assignment belongs to

scope_id?: string | null

The ID of the scoped resource. Null when the assignment is unscoped.

scope_type?: string | null

The kind of resource this grant is scoped to (e.g. zone). Null when the assignment is unscoped (applies to the owning zone itself).

List application role assignments

import KeycardAPI from '@keycardai/api';

const client = new KeycardAPI({
  apiKey: process.env['KEYCARD_API_API_KEY'], // This is the default and can be omitted
});

const roles = await client.zones.applications.roles.list('applicationId', { zoneId: 'zoneId' });

console.log(roles.items);
{
  "items": [
    {
      "id": "id",
      "created_at": "2019-12-27T18:11:19.117Z",
      "principal_id": "principal_id",
      "principal_type": "principal_type",
      "role_id": "role_id",
      "role_identifier": "role_identifier",
      "role_owner_type": "platform",
      "updated_at": "2019-12-27T18:11:19.117Z",
      "zone_id": "zone_id",
      "scope_id": "scope_id",
      "scope_type": "scope_type"
    }
  ],
  "pagination": {
    "after_cursor": "x",
    "before_cursor": "x",
    "total_count": 0
  }
}
Returns Examples
{
  "items": [
    {
      "id": "id",
      "created_at": "2019-12-27T18:11:19.117Z",
      "principal_id": "principal_id",
      "principal_type": "principal_type",
      "role_id": "role_id",
      "role_identifier": "role_identifier",
      "role_owner_type": "platform",
      "updated_at": "2019-12-27T18:11:19.117Z",
      "zone_id": "zone_id",
      "scope_id": "scope_id",
      "scope_type": "scope_type"
    }
  ],
  "pagination": {
    "after_cursor": "x",
    "before_cursor": "x",
    "total_count": 0
  }
}