---
title: RBAC Roles
url: https://platform.claude.com/docs/en/api/php/beta/organization/rbac_roles
---

# RBAC Roles

## List RBAC Roles

`$client->beta->organization->rbacRoles->list(?int limit, ?string page): PageCursor<RBACRole>`

**GET** `/v1/organizations/rbac_roles`

List RBAC Roles in the organization.

The RBAC Roles API is available to Claude Enterprise organizations only.

### Parameters

- `limit?:optional int` (query parameter)

  Number of items to return per page.

  Defaults to `20`. Ranges from `1` to `1000`.

  default: 20

- `page?:optional string` (query parameter)

  Optionally set to the `next_page` token from the previous response.

### Returns

- `class RBACRole`

  - `"rbac_role" type`

    Object type.

    For RBAC Roles, this is always `"rbac_role"`.

  - `string id`

    ID of the RBAC Role.

  - `\Datetime createdAt`

    RFC 3339 datetime string indicating when the RBAC Role was created.

  - `string displayName`

    Name of the RBAC Role. For a role created by Anthropic, this name can differ from the label claude.ai shows, and Anthropic may change the name. To keep a lasting reference to a role, store its `id`.

  - `\Datetime updatedAt`

    RFC 3339 datetime string indicating when the RBAC Role was last updated.

### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$page = $client->beta->organization->rbacRoles->list(
  limit: 1, page: 'eyJjdXJzb3IiOiAicmJhY19yb2xlXzAxIn0'
);

var_dump($page);
```

#### Response (200)

```json
{
  "data": [
    {
      "id": "rbac_role_016J8xVtKpDq3Wy9ZmN2hR4s",
      "created_at": "2024-10-30T23:58:27.427722Z",
      "display_name": "Project Editor",
      "type": "rbac_role",
      "updated_at": "2024-10-30T23:58:27.427722Z"
    }
  ],
  "has_more": true,
  "next_page": "eyJjdXJzb3IiOiAicmJhY19yb2xlXzAxIn0"
}
```

## Get RBAC Role

`$client->beta->organization->rbacRoles->retrieve(string rbacRoleID): RBACRole`

**GET** `/v1/organizations/rbac_roles/{rbac_role_id}`

Retrieve an RBAC Role by ID.

The RBAC Roles API is available to Claude Enterprise organizations only.

### Parameters

- `rbacRoleID: string` (path parameter)

  ID of the RBAC Role.

### Returns

- `class RBACRole`

  - `"rbac_role" type`

    Object type.

    For RBAC Roles, this is always `"rbac_role"`.

  - `string id`

    ID of the RBAC Role.

  - `\Datetime createdAt`

    RFC 3339 datetime string indicating when the RBAC Role was created.

  - `string displayName`

    Name of the RBAC Role. For a role created by Anthropic, this name can differ from the label claude.ai shows, and Anthropic may change the name. To keep a lasting reference to a role, store its `id`.

  - `\Datetime updatedAt`

    RFC 3339 datetime string indicating when the RBAC Role was last updated.

### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$betaRBACRole = $client->beta->organization->rbacRoles->retrieve(
  'rbac_role_id'
);

var_dump($betaRBACRole);
```

#### Response (200)

```json
{
  "id": "rbac_role_016J8xVtKpDq3Wy9ZmN2hR4s",
  "created_at": "2024-10-30T23:58:27.427722Z",
  "display_name": "Project Editor",
  "type": "rbac_role",
  "updated_at": "2024-10-30T23:58:27.427722Z"
}
```

## Domain types

### Beta RBAC Role

- `class RBACRole`

  - `"rbac_role" type`

    Object type.

    For RBAC Roles, this is always `"rbac_role"`.

  - `string id`

    ID of the RBAC Role.

  - `\Datetime createdAt`

    RFC 3339 datetime string indicating when the RBAC Role was created.

  - `string displayName`

    Name of the RBAC Role. For a role created by Anthropic, this name can differ from the label claude.ai shows, and Anthropic may change the name. To keep a lasting reference to a role, store its `id`.

  - `\Datetime updatedAt`

    RFC 3339 datetime string indicating when the RBAC Role was last updated.

## RBAC Roles › Permissions

### List RBAC Role Permissions

`$client->beta->organization->rbacRoles->permissions->list(string rbacRoleID, ?int limit, ?string page): PageCursor<BetaRBACRolePermission>`

**GET** `/v1/organizations/rbac_roles/{rbac_role_id}/permissions`

List the permissions an RBAC Role grants.

The RBAC Roles API is available to Claude Enterprise organizations only.

#### Parameters

- `rbacRoleID: string` (path parameter)

  ID of the RBAC Role.

- `limit?:optional int` (query parameter)

  Number of items to return per page.

  Defaults to `20`. Ranges from `1` to `1000`.

  default: 20

- `page?:optional string` (query parameter)

  Optionally set to the `next_page` token from the previous response.

#### Returns

- `class BetaRBACRolePermission`

  - `"rbac_role_permission" type`

    Object type.

    For RBAC Role Permissions, this is always `"rbac_role_permission"`.

  - `string action`

    Action the permission grants on the resource.

    The vocabulary follows the resource: an `organization` grant carries a
    product-feature entitlement (for example `chat`), an admin-panel
    permission entitlement (`permission_*`), or a blanket capability-access
    mode — `capability_access_all` grants every product-feature entitlement,
    and `capability_access_all_ga` grants the generally-available subset as
    it stands at permission-check time; neither mode grants model-access
    entitlements. A consumer enumerating a role's per-feature grants should
    treat a blanket row as granting every product-feature entitlement it
    covers, or it will under-report the role's effective access. A `connector_tool` grant carries
    a tool-access action (`use` or `always_allow`); a `connector_scope` grant
    carries the scope action `grant` (the role may receive the named OAuth
    scope when tokens are minted for the connector); `connector` and
    `all_connectors` grants carry a tool-access action, the scope action, or
    an authentication-method action (`interactive` or `managed`).

  - `Resource resource`

    What the permission applies to.

    A tagged union: `type` names the kind of resource and determines which
    identifier fields are present.

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$page = $client->beta->organization->rbacRoles->permissions->list(
  'rbac_role_id', limit: 1, page: 'eyJjdXJzb3IiOiAicmJhY19yb2xlXzAxIn0'
);

var_dump($page);
```

##### Response (200)

```json
{
  "data": [
    {
      "action": "use",
      "resource": {
        "organization_id": "3c4f5e6d-7a8b-49c0-9d1e-2f3a4b5c6d7e",
        "type": "organization"
      },
      "type": "rbac_role_permission"
    }
  ],
  "has_more": true,
  "next_page": "eyJjdXJzb3IiOiAicmJhY19yb2xlXzAxIn0"
}
```