> ## Documentation Index
> Fetch the complete documentation index at: https://koreai.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# List workspace roles

> Lists the built-in workspace roles with their permissions and whether a key may assign each. Custom roles are not returned.

**Required scope:** `workspace.roles.read`

Use this endpoint to list the built-in workspace roles, their permissions, and whether a platform key can assign each role. The endpoint does not return custom roles.

Check `assignableByCaller` before you assign a role. It is the source of truth. A key can assign only `builtin.workspace.restricted_member` and `builtin.workspace.workbench_manager`. The request needs the `workspace.roles.read` scope.


## OpenAPI

````yaml agent-platform/api-specs/user-management.yaml get /api/public/v1/workspaces/{workspaceId}/roles
openapi: 3.0.3
info:
  title: Artemis User and Role Management API
  version: 1.9.1
  description: >-
    Provision, update and remove workspace and project members from an identity
    provider, HR system or script.


    **Authentication.** Send a platform key in `X-API-Key` or as `Authorization:
    Bearer <key>`. Workspace endpoints need a workspace platform key
    (`abl_ws_…`), created by a workspace Owner or Admin under **Settings >
    Secrets > Platform Keys**. Project endpoints also accept a project platform
    key bound to that project. User session and SDK tokens are rejected with
    `401`.


    **Scopes.** `workspace.members.read`, `workspace.members.write`,
    `workspace.roles.read`, `project.members.read`, `project.members.write`. A
    missing scope returns `403 INSUFFICIENT_SCOPE`.


    **Roles a key can assign.** Workspace:
    `builtin.workspace.restricted_member`,
    `builtin.workspace.workbench_manager`. Project: `builtin.project.developer`,
    `builtin.project.tester`, `builtin.project.viewer`,
    `builtin.project.workbench_manager`. Owner, Admin, Auditor, project Admin,
    the built-in Operator/Member/Viewer workspace roles and custom roles are
    never assignable by a key. The roles endpoints return `assignableByCaller`
    per role.


    **Envelope.** Success: `{ "success": true, "data": … }`. Error: `{
    "success": false, "error": { "code", "message", "details" } }`. Every
    response carries `X-Request-Id`.


    **Limits.** Per key: 300 reads/min, 60 writes/min (1,000 items), 300
    removals/min, 5 requests in flight. Per workspace: 1,000 reads/min, 200
    writes/min (3,000 items), 600 removals/min. Batches: 100 items, 1 MiB.
    Invitation email: 500/hour per workspace, 3 per address per 24 hours.
    Exceeding a limit returns `429` with `Retry-After`.
servers:
  - url: https://{platformHost}
    description: Your regional Artemis platform host
    variables:
      platformHost:
        default: platform.example.com
        description: Region-specific platform host.
security:
  - platformApiKey: []
  - bearerPlatformKey: []
tags:
  - name: Workspace members
    description: >-
      Invite, list, update, remove and run lifecycle actions on workspace
      members.
  - name: Roles
    description: Read built-in workspace and project roles.
  - name: Projects
    description: Discover the workspace’s projects.
  - name: Project members
    description: Add, list, update and remove project members.
paths:
  /api/public/v1/workspaces/{workspaceId}/roles:
    get:
      tags:
        - Roles
      summary: List workspace roles
      description: >-
        Lists the built-in workspace roles with their permissions and whether a
        key may assign each. Custom roles are not returned.


        **Required scope:** `workspace.roles.read`
      operationId: listWorkspaceRoles
      parameters:
        - schema:
            type: string
            minLength: 1
          required: true
          name: workspaceId
          in: path
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                type: object
                required:
                  - success
                  - data
                properties:
                  success:
                    type: boolean
                    enum:
                      - true
                  data:
                    type: object
                    required:
                      - roles
                    properties:
                      roles:
                        type: array
                        items:
                          $ref: '#/components/schemas/WorkspaceRole'
          headers:
            X-Request-Id:
              $ref: '#/components/headers/RequestId'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/InternalError'
        '503':
          $ref: '#/components/responses/ServiceUnavailable'
      security:
        - platformApiKey: []
        - bearerPlatformKey: []
components:
  schemas:
    WorkspaceRole:
      type: object
      required:
        - roleId
        - name
        - assignableAt
        - permissions
        - effectivePermissions
        - assignableByCaller
      properties:
        id:
          type: string
          description: Same as `roleId`.
        roleId:
          type: string
          example: builtin.workspace.restricted_member
        name:
          type: string
          example: RESTRICTED_MEMBER
        description:
          type: string
          nullable: true
        assignableAt:
          type: array
          items:
            type: string
            enum:
              - workspace
        permissions:
          type: array
          items:
            type: string
        effectivePermissions:
          type: array
          items:
            type: string
        parentRoleId:
          type: string
          nullable: true
        apiAssignable:
          type: boolean
        assignableByCaller:
          type: boolean
          description: >-
            Whether a platform key may assign this role. Treat it as the source
            of truth.
        reasons:
          type: array
          items:
            type: string
          description: Why the role is not assignable, for example `exposes_secret_values`.
        revision:
          type: integer
        createdAt:
          type: string
          format: date-time
          nullable: true
        updatedAt:
          type: string
          format: date-time
          nullable: true
    Error:
      type: object
      required:
        - success
        - error
      properties:
        success:
          type: boolean
          enum:
            - false
        error:
          type: object
          required:
            - code
            - message
          properties:
            code:
              type: string
              example: INSUFFICIENT_SCOPE
            message:
              type: string
            messages:
              type: array
              items:
                type: string
            retryable:
              type: boolean
            details:
              type: object
              additionalProperties: true
              description: >-
                Code-specific context, for example `requiredScope`,
                `currentStatus`, `reason` or `requestId`.
  headers:
    RequestId:
      description: Request ID. Quote it to Kore.ai Support.
      schema:
        type: string
    RetryAfter:
      description: Seconds to wait before retrying.
      schema:
        type: integer
  responses:
    BadRequest:
      description: >-
        Invalid request. Codes: `VALIDATION_ERROR`, `BATCH_EMPTY`,
        `BATCH_TOO_LARGE`, `DUPLICATE_IN_REQUEST`, `GROUPS_NOT_SUPPORTED`,
        `INVALID_CURSOR`, `INVALID_FILTER`, `INVALID_ACTION`,
        `NO_FIELDS_TO_UPDATE`, `INVALID_EXTERNAL_ID`,
        `ROLE_NOT_ASSIGNABLE_AT_SCOPE`.
      headers:
        X-Request-Id:
          $ref: '#/components/headers/RequestId'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
    Unauthorized:
      description: >-
        `UNAUTHORIZED`: the key is missing, unknown, expired or revoked, or a
        user session or SDK token was sent. `KEY_DISABLED`: the key was
        suspended because its owner was not reassigned within 14 days.
      headers:
        X-Request-Id:
          $ref: '#/components/headers/RequestId'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
    Forbidden:
      description: >-
        Codes: `INSUFFICIENT_SCOPE` (`details.requiredScope`),
        `KEY_TYPE_NOT_ALLOWED`, `OWNER_NOT_GRANTABLE_BY_KEY`,
        `SENSITIVE_ROLE_NOT_GRANTABLE_BY_KEY`, `ROLE_ABOVE_CALLER_AUTHORITY`,
        `CANNOT_MODIFY_OWNER`, `CANNOT_REMOVE_OWNER`,
        `CANNOT_MODIFY_KEY_CREATOR`, `TARGET_ABOVE_CALLER_AUTHORITY`,
        `PROJECT_OWNER_IMMUTABLE`, `AZURE_WORKSPACE_MANAGEMENT_RESTRICTED`.
      headers:
        X-Request-Id:
          $ref: '#/components/headers/RequestId'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
    NotFound:
      description: >-
        Codes: `WORKSPACE_NOT_FOUND`, `PROJECT_NOT_FOUND`, `MEMBER_NOT_FOUND`,
        `PROJECT_MEMBER_NOT_FOUND`, `ROLE_NOT_FOUND`. Also returned for
        resources outside the key’s workspace.
      headers:
        X-Request-Id:
          $ref: '#/components/headers/RequestId'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
    TooManyRequests:
      description: >-
        `RATE_LIMITED` or `CONCURRENCY_LIMIT_EXCEEDED`. Wait for `Retry-After`
        seconds.
      headers:
        X-Request-Id:
          $ref: '#/components/headers/RequestId'
        Retry-After:
          $ref: '#/components/headers/RetryAfter'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
    InternalError:
      description: >-
        `INTERNAL_ERROR`. Retry after a short delay; `details.requestId`
        identifies the request.
      headers:
        X-Request-Id:
          $ref: '#/components/headers/RequestId'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
    ServiceUnavailable:
      description: >-
        `AUTH_UNAVAILABLE` or `DEPENDENCY_UNAVAILABLE`. A platform dependency is
        down; retry later.
      headers:
        X-Request-Id:
          $ref: '#/components/headers/RequestId'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
  securitySchemes:
    platformApiKey:
      type: apiKey
      in: header
      name: X-API-Key
      description: Platform key, for example `abl_ws_…`.
    bearerPlatformKey:
      type: http
      scheme: bearer
      bearerFormat: Platform API Key
      description: The same platform key as a bearer token.

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.