API - Roles

Role-based access control (RBAC) definitions.

List Roles

GET /v1/roles

curl http://localhost:7200/v1/roles \
  -H "Authorization: Bearer $ROOT_TOKEN"

Response:

{
  "roles": [
    {
      "name": "admin",
      "description": "Full access to all resources",
      "permissions": ["read", "write", "delete", "manage_tokens", "manage_roles", "view_audit", "manage_namespaces"]
    },
    {
      "name": "developer",
      "description": "Can read and write config/secrets in assigned namespaces",
      "permissions": ["read", "write", "delete"]
    },
    {
      "name": "viewer",
      "description": "Read-only access to assigned namespaces",
      "permissions": ["read"]
    },
    {
      "name": "operator",
      "description": "Can read, write, and view audit logs in assigned namespaces",
      "permissions": ["read", "write", "delete", "view_audit"]
    }
  ],
  "count": 4
}

Get Role Details

GET /v1/roles/{role}

curl http://localhost:7200/v1/roles/developer \
  -H "Authorization: Bearer $ROOT_TOKEN"

Role Summary

Role	Permissions
admin	read, write, delete, manage_tokens, manage_roles, view_audit, manage_namespaces
developer	read, write, delete
viewer	read
operator	read, write, delete, view_audit

Create tokens with a role via POST /v1/auth/token. See API - Auth.