> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tai42.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# List roles

> The seeded/operator-authored roles as full ``RoleDefinition``-shaped bodies
(``{name, description, scopes, condition, condition_id, condition_kwargs, base_tier,
allow_all, grants}``) — the users-admin role picker and the Studio Roles page read
this. A store-less deployment (no versioned store configured) has no roles — the seed
step is skipped at boot — so the read is skipped and the list is empty.

Admin-only: a listing exposes every role's raw base-tier jq condition, so a non-admin
caller is denied 403. This op-level check is defense in depth behind the ``secret``
route action-class that already fences the route.



## OpenAPI

````yaml /openapi.json get /api/auth/roles
openapi: 3.1.0
info:
  description: The operator HTTP surface served under /api/*.
  title: tai42-skeleton API
  version: 0.1.1
servers: []
security: []
paths:
  /api/auth/roles:
    get:
      tags:
        - access-control
      summary: List roles
      description: >-
        The seeded/operator-authored roles as full ``RoleDefinition``-shaped
        bodies

        (``{name, description, scopes, condition, condition_id,
        condition_kwargs, base_tier,

        allow_all, grants}``) — the users-admin role picker and the Studio Roles
        page read

        this. A store-less deployment (no versioned store configured) has no
        roles — the seed

        step is skipped at boot — so the read is skipped and the list is empty.


        Admin-only: a listing exposes every role's raw base-tier jq condition,
        so a non-admin

        caller is denied 403. This op-level check is defense in depth behind the
        ``secret``

        route action-class that already fences the route.
      operationId: get_api_auth_roles
      responses:
        '200':
          content:
            application/json:
              schema:
                properties:
                  data: {}
                required:
                  - data
                type: object
          description: Success.
        '401':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
          description: Missing or invalid api key.
        '403':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
          description: Forbidden.
      security:
        - ApiKeyAuth: []
components:
  schemas:
    Error:
      properties:
        error:
          type: string
      required:
        - error
      type: object
  securitySchemes:
    ApiKeyAuth:
      in: header
      name: x-api-key
      type: apiKey

````