Roles

Custom (tenant-defined) roles granting per-entity capability sets. Capabilities are independent flags — granting Import does not imply Delete; Admin on an entity grants everything on it. Create and update cap the requested grants at the capabilities the requesting user holds, so a role manager can never hand out more access than they have. Deletion is blocked while users are assigned to the role. The built-in system roles (Admin, Standard User, Viewer) are code-defined and not managed here.

GET List Roles
Lists all Roles for the given tenant.
/tenants/{tenant}/roles
POST Create Role
Creates a custom role. Requested permissions are capped at the capabilities the requesting user holds on each entity.
/tenants/{tenant}/roles
GET Get Role
Gets a Role for the specified tenant.
/tenants/{tenant}/roles/{code}
DELETE Delete Role
Deletes a Role for the specified tenant.
/tenants/{tenant}/roles/{code}
PUT Update Role
Replaces a custom role's name, description and permission set. Requested permissions are capped at the capabilities the requesting user holds on each ...
/tenants/{tenant}/roles/{code}
GET List System Role Permissions
Lists the built-in system roles and the capabilities each grants, intersected with the tenant's package.
/tenants/{tenant}/roles/system