Permissions
List RBAC Role Permissions
$client->beta->organization->rbacRoles->permissions->list(string rbacRoleID, ?int limit, ?string page): PageCursor<BetaRBACRolePermission>List the permissions an RBAC Role grants.
Models
class BetaRBACAllConnectorsPermissionResource { $type = 'all_connectors'; }
Kind of resource the permission applies to.
class BetaRBACConnectorPermissionResource { $type = 'connector'; $connectorID; }
Kind of resource the permission applies to.
ID of the connector the permission applies to.
class BetaRBACConnectorScopePermissionResource { $type = 'connector_scope'; $connectorID; $scope; }
Kind of resource the permission applies to.
ID of the connector the permission applies to.
string scopeOAuth scope the permission names — the role may receive this scope when
tokens are minted for the connector.
OAuth scope the permission names — the role may receive this scope when tokens are minted for the connector.
Subject to the same encoding rule as tool_name: a scope containing
characters outside [a-zA-Z0-9_-] (or colliding with a reserved form)
appears server-encoded in a stable {prefix}_{32-hex} form. OAuth
scopes routinely contain : and /, so most appear encoded.
class BetaRBACConnectorToolPermissionResource { $type = 'connector_tool'; $connectorID; $toolName; }
Kind of resource the permission applies to.
ID of the connector the permission applies to.
string toolNamePublished name of the connector tool the permission applies to.
Published name of the connector tool the permission applies to.
When the published name contains characters outside [a-zA-Z0-9_-] (or
collides with a reserved form), it is server-encoded into a stable
{prefix}_{32-hex} form — a shortened readable prefix of the name plus
a hash — from which the published name is not recoverable.
class BetaRBACOrganizationPermissionResource { $type = 'organization'; $organizationID; }
Kind of resource the permission applies to.
UUID of the organization the permission applies to.
class BetaRBACRolePermission { $type = 'rbac_role_permission'; $action; $resource; }
"rbac_role_permission" typeObject type.
Object type.
For RBAC Role Permissions, this is always "rbac_role_permission".
string actionAction the permission grants on the resource.
Action the permission grants on the resource.
The vocabulary follows the resource: an organization grant carries a
product-feature entitlement (for example chat), an admin-panel
permission entitlement (permission_*), or a blanket capability-access
mode — capability_access_all grants every product-feature entitlement,
and capability_access_all_ga grants the generally-available subset as
it stands at permission-check time; neither mode grants model-access
entitlements. A consumer enumerating a role's per-feature grants should
treat a blanket row as granting every product-feature entitlement it
covers, or it will under-report the role's effective access. A connector_tool grant carries
a tool-access action (use or always_allow); a connector_scope grant
carries the scope action grant (the role may receive the named OAuth
scope when tokens are minted for the connector); connector and
all_connectors grants carry a tool-access action, the scope action, or
an authentication-method action (interactive or managed).
Resource resourceWhat the permission applies to.
What the permission applies to.
A tagged union: type names the kind of resource and determines which
identifier fields are present.