List roles

GET /v1/tenants/{tenant}/db/roles

Inspect roles and their inheritanceBuilt-in system roles can appear without being editable.

Request the role inventoryList database roles in this tenant.
Inspect inherited rolesSee how permissions are shared between roles.
Recognize system rolesCheck the system flag before planning changes.

Before you start

Use your database bearer token.

Use an identity authorized to manage access in this tenant.

Path parameters

Field	Type	Required
`tenant`	`string`	Required

Headers

Field	Type	Required	Description
`x-oc-db-user`	`string`	Optional	Acting database user (role, grant and row-policy checks). Send with x-oc-db-key.
`x-oc-db-key`	`string`	Optional	API key of the x-oc-db-user user.

Read the result

roles includes inherited-role names and the system flag. Built-in roles appear in this listing; seeing a role here does not mean it can be edited or deleted.

Response statuses

HTTP status reference

Status	What to do
200	OK
400	Correct the request before retrying.
401	Check the credential and Authorization header.
402	Check feature access or available credits.
403	Check tenant access, roles and permissions.
429	Honor Retry-After when present; back off.
503	Honor Retry-After when present; check write outcomes.

Request example

curl --include --request GET "${OC_BASE_URL}/v1/tenants/${OC_TENANT}/db/roles" \
  --header "Authorization: Bearer ${OC_TOKEN}"

Response example

Examples use synthetic values to show the response format.

Response status

{
  "roles": [
    {
      "name": "demo_reader",
      "inherits": [],
      "system": false,
      "created_unix": 1793318400
    }
  ]
}

Illustrative entry; system roles or other roles may also be returned.

Download the OpenAPI specification for the complete response schemas.

Before you startCopy Anchor Link

Path parametersCopy Anchor Link

HeadersCopy Anchor Link

Read the resultCopy Anchor Link

Response statusesCopy Anchor Link

Before you start

Path parameters

Headers

Read the result

Response statuses