--- title: Permissions url: https://platform.claude.com/docs/en/api/go/beta/organization/rbac_roles/permissions --- # Permissions ## List RBAC Role Permissions `client.Beta.Organization.RBACRoles.Permissions.List(ctx, rbacRoleID, query) (*PageCursor[BetaRBACRolePermission], error)` **GET** `/v1/organizations/rbac_roles/{rbac_role_id}/permissions` List the permissions an RBAC Role grants. The RBAC Roles API is available to Claude Enterprise organizations only. ### Parameters - `rbacRoleID string` (path parameter) ID of the RBAC Role. - `query BetaOrganizationRBACRolePermissionListParams` - `Limit param.Opt[int64] Optional` (query parameter) Number of items to return per page. Defaults to `20`. Ranges from `1` to `1000`. minimum: 1, maximum: 1000 - `Page param.Opt[string] Optional` (query parameter) Optionally set to the `next_page` token from the previous response. ### Returns - `type BetaRBACRolePermission` - `Type RBACRolePermission` Object type. For RBAC Role Permissions, this is always `"rbac_role_permission"`. default: rbac_role_permission - `Action string` Action the permission grants on the resource. The vocabulary follows the resource: an `organization` grant carries a product-feature entitlement (for example `chat`), an admin-panel permission entitlement (`permission_*`), or a blanket capability-access mode — `capability_access_all` grants every product-feature entitlement, and `capability_access_all_ga` grants the generally-available subset as it stands at permission-check time; neither mode grants model-access entitlements. A consumer enumerating a role's per-feature grants should treat a blanket row as granting every product-feature entitlement it covers, or it will under-report the role's effective access. A `connector_tool` grant carries a tool-access action (`use` or `always_allow`); a `connector_scope` grant carries the scope action `grant` (the role may receive the named OAuth scope when tokens are minted for the connector); `connector` and `all_connectors` grants carry a tool-access action, the scope action, or an authentication-method action (`interactive` or `managed`). - `Resource BetaRBACRolePermissionResourceUnion` What the permission applies to. A tagged union: `type` names the kind of resource and determines which identifier fields are present. - `type BetaRBACOrganizationPermissionResource` - `Type Organization` Kind of resource the permission applies to. default: organization - `OrganizationID string` UUID of the organization the permission applies to. - `type BetaRBACConnectorToolPermissionResource` - `Type ConnectorTool` Kind of resource the permission applies to. default: connector_tool - `ConnectorID string` ID of the connector the permission applies to. - `ToolName string` Published name of the connector tool the permission applies to. When the published name contains characters outside `[a-zA-Z0-9_-]` (or collides with a reserved form), it is server-encoded into a stable `{prefix}_{32-hex}` form — a shortened readable prefix of the name plus a hash — from which the published name is not recoverable. - `type BetaRBACConnectorScopePermissionResource` - `Type ConnectorScope` Kind of resource the permission applies to. default: connector_scope - `ConnectorID string` ID of the connector the permission applies to. - `Scope string` OAuth scope the permission names — the role may receive this scope when tokens are minted for the connector. Subject to the same encoding rule as `tool_name`: a scope containing characters outside `[a-zA-Z0-9_-]` (or colliding with a reserved form) appears server-encoded in a stable `{prefix}_{32-hex}` form. OAuth scopes routinely contain `:` and `/`, so most appear encoded. - `type BetaRBACConnectorPermissionResource` - `Type Connector` Kind of resource the permission applies to. default: connector - `ConnectorID string` ID of the connector the permission applies to. - `type BetaRBACAllConnectorsPermissionResource` - `Type AllConnectors` Kind of resource the permission applies to. default: all_connectors ### Example ```go package main import ( "context" "fmt" "github.com/anthropics/anthropic-sdk-go" "github.com/anthropics/anthropic-sdk-go/option" ) func main() { client := anthropic.NewClient( option.WithAPIKey("my-anthropic-api-key"), ) page, err := client.Beta.Organization.RBACRoles.Permissions.List( context.TODO(), "rbac_role_id", anthropic.BetaOrganizationRBACRolePermissionListParams{}, ) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", page) } ``` #### Response (200) ```json { "data": [ { "action": "use", "resource": { "organization_id": "3c4f5e6d-7a8b-49c0-9d1e-2f3a4b5c6d7e", "type": "organization" }, "type": "rbac_role_permission" } ], "has_more": true, "next_page": "eyJjdXJzb3IiOiAicmJhY19yb2xlXzAxIn0" } ``` ## Domain types ### Beta RBAC All Connectors Permission Resource - `type BetaRBACAllConnectorsPermissionResource` - `Type AllConnectors` Kind of resource the permission applies to. default: all_connectors ### Beta RBAC Connector Permission Resource - `type BetaRBACConnectorPermissionResource` - `Type Connector` Kind of resource the permission applies to. default: connector - `ConnectorID string` ID of the connector the permission applies to. ### Beta RBAC Connector Scope Permission Resource - `type BetaRBACConnectorScopePermissionResource` - `Type ConnectorScope` Kind of resource the permission applies to. default: connector_scope - `ConnectorID string` ID of the connector the permission applies to. - `Scope string` OAuth scope the permission names — the role may receive this scope when tokens are minted for the connector. Subject to the same encoding rule as `tool_name`: a scope containing characters outside `[a-zA-Z0-9_-]` (or colliding with a reserved form) appears server-encoded in a stable `{prefix}_{32-hex}` form. OAuth scopes routinely contain `:` and `/`, so most appear encoded. ### Beta RBAC Connector Tool Permission Resource - `type BetaRBACConnectorToolPermissionResource` - `Type ConnectorTool` Kind of resource the permission applies to. default: connector_tool - `ConnectorID string` ID of the connector the permission applies to. - `ToolName string` Published name of the connector tool the permission applies to. When the published name contains characters outside `[a-zA-Z0-9_-]` (or collides with a reserved form), it is server-encoded into a stable `{prefix}_{32-hex}` form — a shortened readable prefix of the name plus a hash — from which the published name is not recoverable. ### Beta RBAC Organization Permission Resource - `type BetaRBACOrganizationPermissionResource` - `Type Organization` Kind of resource the permission applies to. default: organization - `OrganizationID string` UUID of the organization the permission applies to. ### Beta RBAC Role Permission - `type BetaRBACRolePermission` - `Type RBACRolePermission` Object type. For RBAC Role Permissions, this is always `"rbac_role_permission"`. default: rbac_role_permission - `Action string` Action the permission grants on the resource. The vocabulary follows the resource: an `organization` grant carries a product-feature entitlement (for example `chat`), an admin-panel permission entitlement (`permission_*`), or a blanket capability-access mode — `capability_access_all` grants every product-feature entitlement, and `capability_access_all_ga` grants the generally-available subset as it stands at permission-check time; neither mode grants model-access entitlements. A consumer enumerating a role's per-feature grants should treat a blanket row as granting every product-feature entitlement it covers, or it will under-report the role's effective access. A `connector_tool` grant carries a tool-access action (`use` or `always_allow`); a `connector_scope` grant carries the scope action `grant` (the role may receive the named OAuth scope when tokens are minted for the connector); `connector` and `all_connectors` grants carry a tool-access action, the scope action, or an authentication-method action (`interactive` or `managed`). - `Resource BetaRBACRolePermissionResourceUnion` What the permission applies to. A tagged union: `type` names the kind of resource and determines which identifier fields are present. - `type BetaRBACOrganizationPermissionResource` - `Type Organization` Kind of resource the permission applies to. default: organization - `OrganizationID string` UUID of the organization the permission applies to. - `type BetaRBACConnectorToolPermissionResource` - `Type ConnectorTool` Kind of resource the permission applies to. default: connector_tool - `ConnectorID string` ID of the connector the permission applies to. - `ToolName string` Published name of the connector tool the permission applies to. When the published name contains characters outside `[a-zA-Z0-9_-]` (or collides with a reserved form), it is server-encoded into a stable `{prefix}_{32-hex}` form — a shortened readable prefix of the name plus a hash — from which the published name is not recoverable. - `type BetaRBACConnectorScopePermissionResource` - `Type ConnectorScope` Kind of resource the permission applies to. default: connector_scope - `ConnectorID string` ID of the connector the permission applies to. - `Scope string` OAuth scope the permission names — the role may receive this scope when tokens are minted for the connector. Subject to the same encoding rule as `tool_name`: a scope containing characters outside `[a-zA-Z0-9_-]` (or colliding with a reserved form) appears server-encoded in a stable `{prefix}_{32-hex}` form. OAuth scopes routinely contain `:` and `/`, so most appear encoded. - `type BetaRBACConnectorPermissionResource` - `Type Connector` Kind of resource the permission applies to. default: connector - `ConnectorID string` ID of the connector the permission applies to. - `type BetaRBACAllConnectorsPermissionResource` - `Type AllConnectors` Kind of resource the permission applies to. default: all_connectors