Skip to content
Docs

Roles

API Reference
Zones

Roles

List roles
client.zones.roles.list(stringzoneID, RoleListParams { after, before, expand, 2 more } query?, RequestOptionsoptions?): RoleListResponse { items, pagination }
GET/zones/{zoneId}/roles
Create role
client.zones.roles.create(stringzoneID, RoleCreateParams { identifier, description } body, RequestOptionsoptions?): Role { id, created_at, identifier, 4 more }
POST/zones/{zoneId}/roles
Get role
client.zones.roles.retrieve(stringroleID, RoleRetrieveParams { zoneId } params, RequestOptionsoptions?): Role { id, created_at, identifier, 4 more }
GET/zones/{zoneId}/roles/{roleId}
Update role
client.zones.roles.update(stringroleID, RoleUpdateParams { zoneId, description } params, RequestOptionsoptions?): Role { id, created_at, identifier, 4 more }
PATCH/zones/{zoneId}/roles/{roleId}
Delete role
client.zones.roles.delete(stringroleID, RoleDeleteParams { zoneId } params, RequestOptionsoptions?): void
DELETE/zones/{zoneId}/roles/{roleId}
ModelsExpand Collapse
Role { id, created_at, identifier, 4 more }

A role that can be assigned to users within a zone.

id: string

Unique identifier of the role

created_at: string

Entity creation timestamp

formatdate-time
identifier: string

Role identifier: a lowercase slug (letters and digits separated by single hyphens or underscores), unique per owner type within a zone. Role identifiers surface in policy evaluation, so the slug restriction keeps them unambiguous in policy text.

minLength1
maxLength255
owner_type: "platform" | "customer"

Who owns this role. Platform-owned roles are managed by Keycard and cannot be modified or deleted via the API; customer-owned roles are user-created.

Accepts one of the following:
"platform"
"customer"
updated_at: string

Entity update timestamp

formatdate-time
zone_id: string

Zone this role belongs to

description?: string | null

Human-readable description

maxLength1000
RoleCreate { identifier, description }

Schema for creating a new role

identifier: string

Role identifier: a lowercase slug (letters and digits separated by single hyphens or underscores), unique per owner type within a zone. Role identifiers surface in policy evaluation, so the slug restriction keeps them unambiguous in policy text.

minLength1
maxLength255
description?: string

Human-readable description

maxLength1000
RoleUpdate { description }

Schema for updating an existing role. The role identifier is immutable.

description?: string | null

Human-readable description (set to null to unset)

maxLength1000