--- title: RBAC Roles url: https://platform.claude.com/docs/en/api/java/beta/organization/rbac_roles --- # RBAC Roles ## List RBAC Roles `RbacRoleListPage beta().organization().rbacRoles().list(params = RbacRoleListParams.none(), requestOptions = RequestOptions.none())` **GET** `/v1/organizations/rbac_roles` List RBAC Roles in the organization. The RBAC Roles API is available to Claude Enterprise organizations only. ### Parameters - `RbacRoleListParams params` - `Optional limit` (query parameter) Number of items to return per page. Defaults to `20`. Ranges from `1` to `1000`. minimum: 1, maximum: 1000 - `Optional page` (query parameter) Optionally set to the `next_page` token from the previous response. ### Returns - `class BetaRbacRole` - `JsonValue type = "rbac_role"` Object type. For RBAC Roles, this is always `"rbac_role"`. - `String id` ID of the RBAC Role. - `LocalDateTime createdAt` RFC 3339 datetime string indicating when the RBAC Role was created. format: date-time - `String displayName` Name of the RBAC Role. For a role created by Anthropic, this name can differ from the label claude.ai shows, and Anthropic may change the name. To keep a lasting reference to a role, store its `id`. - `LocalDateTime updatedAt` RFC 3339 datetime string indicating when the RBAC Role was last updated. format: date-time - `String name` **Deprecated**: Use `display_name` instead; `name` always has the same value. Deprecated: use `display_name` instead. Name of the RBAC Role; always the same value as `display_name`. ### Example ```java package com.anthropic.example; import com.anthropic.client.AnthropicClient; import com.anthropic.client.okhttp.AnthropicOkHttpClient; import com.anthropic.models.beta.organization.rbacroles.RbacRoleListPage; import com.anthropic.models.beta.organization.rbacroles.RbacRoleListParams; public final class Main { private Main() {} public static void main(String[] args) { AnthropicClient client = AnthropicOkHttpClient.fromEnv(); RbacRoleListPage page = client.beta().organization().rbacRoles().list(); } } ``` #### Response (200) ```json { "data": [ { "id": "rbac_role_016J8xVtKpDq3Wy9ZmN2hR4s", "created_at": "2024-10-30T23:58:27.427722Z", "display_name": "Project Editor", "name": "Project Editor", "type": "rbac_role", "updated_at": "2024-10-30T23:58:27.427722Z" } ], "has_more": true, "next_page": "eyJjdXJzb3IiOiAicmJhY19yb2xlXzAxIn0" } ``` ## Get RBAC Role `BetaRbacRole beta().organization().rbacRoles().retrieve(params = RbacRoleRetrieveParams.none(), requestOptions = RequestOptions.none())` **GET** `/v1/organizations/rbac_roles/{rbac_role_id}` Retrieve an RBAC Role by ID. The RBAC Roles API is available to Claude Enterprise organizations only. ### Parameters - `RbacRoleRetrieveParams params` - `Optional rbacRoleId` (path parameter) ID of the RBAC Role. ### Returns - `class BetaRbacRole` - `JsonValue type = "rbac_role"` Object type. For RBAC Roles, this is always `"rbac_role"`. - `String id` ID of the RBAC Role. - `LocalDateTime createdAt` RFC 3339 datetime string indicating when the RBAC Role was created. format: date-time - `String displayName` Name of the RBAC Role. For a role created by Anthropic, this name can differ from the label claude.ai shows, and Anthropic may change the name. To keep a lasting reference to a role, store its `id`. - `LocalDateTime updatedAt` RFC 3339 datetime string indicating when the RBAC Role was last updated. format: date-time - `String name` **Deprecated**: Use `display_name` instead; `name` always has the same value. Deprecated: use `display_name` instead. Name of the RBAC Role; always the same value as `display_name`. ### Example ```java package com.anthropic.example; import com.anthropic.client.AnthropicClient; import com.anthropic.client.okhttp.AnthropicOkHttpClient; import com.anthropic.models.beta.organization.rbacroles.BetaRbacRole; import com.anthropic.models.beta.organization.rbacroles.RbacRoleRetrieveParams; public final class Main { private Main() {} public static void main(String[] args) { AnthropicClient client = AnthropicOkHttpClient.fromEnv(); BetaRbacRole betaRbacRole = client.beta().organization().rbacRoles().retrieve("rbac_role_id"); } } ``` #### Response (200) ```json { "id": "rbac_role_016J8xVtKpDq3Wy9ZmN2hR4s", "created_at": "2024-10-30T23:58:27.427722Z", "display_name": "Project Editor", "name": "Project Editor", "type": "rbac_role", "updated_at": "2024-10-30T23:58:27.427722Z" } ``` ## Domain types ### Beta RBAC Role - `class BetaRbacRole` - `JsonValue type = "rbac_role"` Object type. For RBAC Roles, this is always `"rbac_role"`. - `String id` ID of the RBAC Role. - `LocalDateTime createdAt` RFC 3339 datetime string indicating when the RBAC Role was created. format: date-time - `String displayName` Name of the RBAC Role. For a role created by Anthropic, this name can differ from the label claude.ai shows, and Anthropic may change the name. To keep a lasting reference to a role, store its `id`. - `LocalDateTime updatedAt` RFC 3339 datetime string indicating when the RBAC Role was last updated. format: date-time - `String name` **Deprecated**: Use `display_name` instead; `name` always has the same value. Deprecated: use `display_name` instead. Name of the RBAC Role; always the same value as `display_name`. ## RBAC Roles › Permissions ### List RBAC Role Permissions `PermissionListPage beta().organization().rbacRoles().permissions().list(params = PermissionListParams.none(), requestOptions = RequestOptions.none())` **GET** `/v1/organizations/rbac_roles/{rbac_role_id}/permissions` List the permissions an RBAC Role grants. The RBAC Roles API is available to Claude Enterprise organizations only. #### Parameters - `PermissionListParams params` - `Optional rbacRoleId` (path parameter) ID of the RBAC Role. - `Optional limit` (query parameter) Number of items to return per page. Defaults to `20`. Ranges from `1` to `1000`. minimum: 1, maximum: 1000 - `Optional page` (query parameter) Optionally set to the `next_page` token from the previous response. #### Returns - `class BetaRbacRolePermission` - `JsonValue type = "rbac_role_permission"` Object type. For RBAC Role Permissions, this is always `"rbac_role_permission"`. - `String action` Action the permission grants on the resource. The vocabulary follows the resource: an `organization` grant carries a product-feature entitlement (for example `chat`), an admin-panel permission entitlement (`permission_*`), or a blanket capability-access mode — `capability_access_all` grants every product-feature entitlement, and `capability_access_all_ga` grants the generally-available subset as it stands at permission-check time; neither mode grants model-access entitlements. A consumer enumerating a role's per-feature grants should treat a blanket row as granting every product-feature entitlement it covers, or it will under-report the role's effective access. A `connector_tool` grant carries a tool-access action (`use` or `always_allow`); a `connector_scope` grant carries the scope action `grant` (the role may receive the named OAuth scope when tokens are minted for the connector); `connector` and `all_connectors` grants carry a tool-access action, the scope action, or an authentication-method action (`interactive` or `managed`). - `Resource resource` What the permission applies to. A tagged union: `type` names the kind of resource and determines which identifier fields are present. - `class BetaRbacOrganizationPermissionResource` - `JsonValue type = "organization"` Kind of resource the permission applies to. - `String organizationId` UUID of the organization the permission applies to. - `class BetaRbacConnectorToolPermissionResource` - `JsonValue type = "connector_tool"` Kind of resource the permission applies to. - `String connectorId` ID of the connector the permission applies to. - `String toolName` Published name of the connector tool the permission applies to. When the published name contains characters outside `[a-zA-Z0-9_-]` (or collides with a reserved form), it is server-encoded into a stable `{prefix}_{32-hex}` form — a shortened readable prefix of the name plus a hash — from which the published name is not recoverable. - `class BetaRbacConnectorScopePermissionResource` - `JsonValue type = "connector_scope"` Kind of resource the permission applies to. - `String connectorId` ID of the connector the permission applies to. - `String scope` OAuth scope the permission names — the role may receive this scope when tokens are minted for the connector. Subject to the same encoding rule as `tool_name`: a scope containing characters outside `[a-zA-Z0-9_-]` (or colliding with a reserved form) appears server-encoded in a stable `{prefix}_{32-hex}` form. OAuth scopes routinely contain `:` and `/`, so most appear encoded. - `class BetaRbacConnectorPermissionResource` - `JsonValue type = "connector"` Kind of resource the permission applies to. - `String connectorId` ID of the connector the permission applies to. - `class BetaRbacAllConnectorsPermissionResource` - `JsonValue type = "all_connectors"` Kind of resource the permission applies to. #### Example ```java package com.anthropic.example; import com.anthropic.client.AnthropicClient; import com.anthropic.client.okhttp.AnthropicOkHttpClient; import com.anthropic.models.beta.organization.rbacroles.permissions.PermissionListPage; import com.anthropic.models.beta.organization.rbacroles.permissions.PermissionListParams; public final class Main { private Main() {} public static void main(String[] args) { AnthropicClient client = AnthropicOkHttpClient.fromEnv(); PermissionListPage page = client.beta().organization().rbacRoles().permissions().list("rbac_role_id"); } } ``` ##### Response (200) ```json { "data": [ { "action": "use", "resource": { "organization_id": "3c4f5e6d-7a8b-49c0-9d1e-2f3a4b5c6d7e", "type": "organization" }, "type": "rbac_role_permission" } ], "has_more": true, "next_page": "eyJjdXJzb3IiOiAicmJhY19yb2xlXzAxIn0" } ```