RBAC Roles changedapi/admin/rbac_roles
Nearest release: v2.1.245, published an hour after this site recorded the change. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Recorded here
Lines+61added
Lines−165removed
From line
1
where the diff opens
First seen
14 Aug 2026
this site's first read of the page
Recorded edits5to this page, all time
### Query parameters ### Headers #### Response (200) ### Path parameters ### Headers #### Response (200) ## Domain types ## RBAC Roles › Permissions ### List RBAC Role Permissions #### Path parameters #### Query parameters #### Headers #### Returns #### Example ##### Response (200) ### Query Parameters ### Header Parameters #### Response ### Path Parameters ### Header Parameters #### Response ## Domain Types # Permissions ## List RBAC Role Permissions ### Path Parameters ### Query Parameters ### Header Parameters #### Response ## Domain Types ### Rbac Role Permission
The whole hunk
from line 1, old and new numbered
/
from line 1
1---
2title: RBAC Roles
3url: https://platform.claude.com/docs/en/api/admin/rbac_roles
4---
5
61# RBAC Roles
72
83## List RBAC Roles
94
10**get** `/v1/organizations/rbac_roles`
5**GET** `/v1/organizations/rbac_roles`
116
127List RBAC Roles in the organization.
138
149The RBAC Roles API is in beta and available to Claude Enterprise organizations only. Requests must send the `ce-user-management-2026-07-13` value in the `anthropic-beta` header.
1510
16### Query Parameters
11### Query parameters
1712
1813- `limit: optional number`
1914
from line 16
2116
2217 Defaults to `20`. Ranges from `1` to `1000`.
2318
19 default: 20, maximum: 1000, minimum: 1
20
2421- `page: optional string`
2522
2623 Optionally set to the `next_page` token from the previous response.
2724
28### Header Parameters
25### Headers
2926
3027- `"anthropic-beta": optional array of string`
3128
from line 42
4542
4643 RFC 3339 datetime string indicating when the RBAC Role was created.
4744
45 format: date-time
46
4847 - `name: string`
4948
5049 Name of the RBAC Role.
from line 54
5554
5655 For RBAC Roles, this is always `"rbac_role"`.
5756
58 - `"rbac_role"`
57 default: rbac_role
5958
6059 - `updated_at: string`
6160
6261 RFC 3339 datetime string indicating when the RBAC Role was last updated.
6362
63 format: date-time
64
6465- `has_more: boolean`
6566
6667 Indicates whether there are more results beyond this page.
from line 73
7273
7374### Example
7475
75```http
76```bash
7677curl https://api.anthropic.com/v1/organizations/rbac_roles \
7778 -H 'anthropic-version: 2023-06-01' \
7879 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
7980```
8081
81#### Response
82#### Response (200)
8283
8384```json
8485{
from line 99
9899
99100## Get RBAC Role
100101
101**get** `/v1/organizations/rbac_roles/{role_id}`
102**GET** `/v1/organizations/rbac_roles/{role_id}`
102103
103104Retrieve an RBAC Role by ID.
104105
105106The RBAC Roles API is in beta and available to Claude Enterprise organizations only. Requests must send the `ce-user-management-2026-07-13` value in the `anthropic-beta` header.
106107
107### Path Parameters
108### Path parameters
108109
109110- `role_id: string`
110111
111112 ID of the RBAC Role.
112113
113### Header Parameters
114### Headers
114115
115116- `"anthropic-beta": optional array of string`
116117
from line 121
120121
121122### Returns
122123
123- `RbacRole object { id, created_at, name, 2 more }`
124- `RbacRole object`
124125
125126 - `id: string`
126127
from line 131
130131
131132 RFC 3339 datetime string indicating when the RBAC Role was created.
132133
134 format: date-time
135
133136 - `name: string`
134137
135138 Name of the RBAC Role.
from line 143
140143
141144 For RBAC Roles, this is always `"rbac_role"`.
142145
143 - `"rbac_role"`
146 default: rbac_role
144147
145148 - `updated_at: string`
146149
147150 RFC 3339 datetime string indicating when the RBAC Role was last updated.
148151
152 format: date-time
153
149154### Example
150155
151```http
156```bash
152157curl https://api.anthropic.com/v1/organizations/rbac_roles/$ROLE_ID \
153158 -H 'anthropic-version: 2023-06-01' \
154159 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
155160```
156161
157#### Response
162#### Response (200)
158163
159164```json
160165{
from line 171
166171}
167172```
168173
169## Domain Types
174## Domain types
170175
171176### Rbac Role
172177
173- `RbacRole object { id, created_at, name, 2 more }`
178- `RbacRole object`
174179
175180 - `id: string`
176181
from line 185
180185
181186 RFC 3339 datetime string indicating when the RBAC Role was created.
182187
188 format: date-time
189
183190 - `name: string`
184191
185192 Name of the RBAC Role.
from line 197
190197
191198 For RBAC Roles, this is always `"rbac_role"`.
192199
193 - `"rbac_role"`
200 default: rbac_role
194201
195202 - `updated_at: string`
196203
197204 RFC 3339 datetime string indicating when the RBAC Role was last updated.
198205
199# Permissions
206 format: date-time
200207
201## List RBAC Role Permissions
208## RBAC Roles › Permissions
202209
203**get** `/v1/organizations/rbac_roles/{role_id}/permissions`
210### List RBAC Role Permissions
204211
212**GET** `/v1/organizations/rbac_roles/{role_id}/permissions`
213
205214List the permissions an RBAC Role grants.
206215
207216The RBAC Roles API is in beta and available to Claude Enterprise organizations only. Requests must send the `ce-user-management-2026-07-13` value in the `anthropic-beta` header.
208217
209### Path Parameters
218#### Path parameters
210219
211220- `role_id: string`
212221
213222 ID of the RBAC Role.
214223
215### Query Parameters
224#### Query parameters
216225
217226- `limit: optional number`
218227
from line 229
220229
221230 Defaults to `20`. Ranges from `1` to `1000`.
222231
232 default: 20, maximum: 1000, minimum: 1
233
223234- `page: optional string`
224235
225236 Optionally set to the `next_page` token from the previous response.
226237
227### Header Parameters
238#### Headers
228239
229240- `"anthropic-beta": optional array of string`
230241
from line 243
232243
233244 To use multiple betas, use a comma separated list like `beta1,beta2` or specify the header multiple times for each beta.
234245
235### Returns
246#### Returns
236247
237248- `data: array of RbacRolePermission`
238249
from line 266
255266 `all_connectors` grants carry a tool-access action, the scope action, or
256267 an authentication-method action (`interactive` or `managed`).
257268
258 - `resource: object { organization_id, type } or object { connector_id, tool_name, type } or object { connector_id, scope, type } or 2 more`
269 - `resource: object or object or object or 2 more`
259270
260271 What the permission applies to.
261272
from line 273
262273 A tagged union: `type` names the kind of resource and determines which
263274 identifier fields are present.
264275
265 - `Organization object { organization_id, type }`
276 - `Organization object`
266277
267278 - `organization_id: string`
268279
from line 283
272283
273284 Kind of resource the permission applies to.
274285
275 - `"organization"`
286 default: organization
276287
277 - `ConnectorTool object { connector_id, tool_name, type }`
288 - `ConnectorTool object`
278289
279290 - `connector_id: string`
280291
from line 304
293304
294305 Kind of resource the permission applies to.
295306
296 - `"connector_tool"`
307 default: connector_tool
297308
298 - `ConnectorScope object { connector_id, scope, type }`
309 - `ConnectorScope object`
299310
300311 - `connector_id: string`
301312
from line 326
315326
316327 Kind of resource the permission applies to.
317328
318 - `"connector_scope"`
329 default: connector_scope
319330
320 - `Connector object { connector_id, type }`
331 - `Connector object`
321332
322333 - `connector_id: string`
323334
from line 338
327338
328339 Kind of resource the permission applies to.
329340
330 - `"connector"`
341 default: connector
331342
332 - `AllConnectors object { type }`
343 - `AllConnectors object`
333344
334345 - `type: "all_connectors"`
335346
336347 Kind of resource the permission applies to.
337348
338 - `"all_connectors"`
349 default: all_connectors
339350
340351 - `type: "rbac_role_permission"`
341352
from line 354
343354
344355 For RBAC Role Permissions, this is always `"rbac_role_permission"`.
345356
346 - `"rbac_role_permission"`
357 default: rbac_role_permission
347358
348359- `has_more: boolean`
349360
from line 365
354365 Opaque cursor for the next page. Pass as the `page` parameter on the next
355366 request.
356367
357### Example
368#### Example
358369
359```http
370```bash
360371curl https://api.anthropic.com/v1/organizations/rbac_roles/$ROLE_ID/permissions \
361372 -H 'anthropic-version: 2023-06-01' \
362373 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
363374```
364375
365#### Response
376##### Response (200)
366377
367378```json
368379{
from line 391
380391 "next_page": "eyJjdXJzb3IiOiAicmJhY19yb2xlXzAxIn0"
381392}
382393```
383
384## Domain Types
385
386### Rbac Role Permission
387
388- `RbacRolePermission object { action, resource, type }`
389
390 - `action: string`
391
392 Action the permission grants on the resource.
393
394 The vocabulary follows the resource: an `organization` grant carries a
395 product-feature entitlement (for example `chat`), an admin-panel
396 permission entitlement (`permission_*`), or a blanket capability-access
397 mode — `capability_access_all` grants every product-feature entitlement,
398 and `capability_access_all_ga` grants the generally-available subset as
399 it stands at permission-check time; neither mode grants model-access
400 entitlements. A consumer enumerating a role's per-feature grants should
401 treat a blanket row as granting every product-feature entitlement it
402 covers, or it will under-report the role's effective access. A `connector_tool` grant carries
403 a tool-access action (`use` or `always_allow`); a `connector_scope` grant
404 carries the scope action `grant` (the role may receive the named OAuth
405 scope when tokens are minted for the connector); `connector` and
406 `all_connectors` grants carry a tool-access action, the scope action, or
407 an authentication-method action (`interactive` or `managed`).
408
409 - `resource: object { organization_id, type } or object { connector_id, tool_name, type } or object { connector_id, scope, type } or 2 more`
410
411 What the permission applies to.
412
413 A tagged union: `type` names the kind of resource and determines which
414 identifier fields are present.
415
416 - `Organization object { organization_id, type }`
417
418 - `organization_id: string`
419
420 UUID of the organization the permission applies to.
421
422 - `type: "organization"`
423
424 Kind of resource the permission applies to.
425
426 - `"organization"`
427
428 - `ConnectorTool object { connector_id, tool_name, type }`
429
430 - `connector_id: string`
431
432 ID of the connector the permission applies to.
433
434 - `tool_name: string`
435
436 Published name of the connector tool the permission applies to.
437
438 When the published name contains characters outside `[a-zA-Z0-9_-]` (or
439 collides with a reserved form), it is server-encoded into a stable
440 `{prefix}_{32-hex}` form — a shortened readable prefix of the name plus
441 a hash — from which the published name is not recoverable.
442
443 - `type: "connector_tool"`
444
445 Kind of resource the permission applies to.
446
447 - `"connector_tool"`
448
449 - `ConnectorScope object { connector_id, scope, type }`
450
451 - `connector_id: string`
452
453 ID of the connector the permission applies to.
454
455 - `scope: string`
456
457 OAuth scope the permission names — the role may receive this scope when
458 tokens are minted for the connector.
459
460 Subject to the same encoding rule as `tool_name`: a scope containing
461 characters outside `[a-zA-Z0-9_-]` (or colliding with a reserved form)
462 appears server-encoded in a stable `{prefix}_{32-hex}` form. OAuth
463 scopes routinely contain `:` and `/`, so most appear encoded.
464
465 - `type: "connector_scope"`
466
467 Kind of resource the permission applies to.
468
469 - `"connector_scope"`
470
471 - `Connector object { connector_id, type }`
472
473 - `connector_id: string`
474
475 ID of the connector the permission applies to.
476
477 - `type: "connector"`
478
479 Kind of resource the permission applies to.
480
481 - `"connector"`
482
483 - `AllConnectors object { type }`
484
485 - `type: "all_connectors"`
486
487 Kind of resource the permission applies to.
488
489 - `"all_connectors"`
490
491 - `type: "rbac_role_permission"`
492
493 Object type.
494
495 For RBAC Role Permissions, this is always `"rbac_role_permission"`.
496
497 - `"rbac_role_permission"`
498394
No line in this hunk matches that.