API and MCP
Roles
The roles a team can grant: the built-in Admin, Member and Viewer roles and an organization's own
List roles
GET /api/v1/org/{orgId}/role
Credentials: API token or dashboard sign-in.
Every role available to the organization: the built-in Admin, Member and Viewer roles first, then the organization's own. Each role carries its id, name, whether it is built in (systemRole) and the permissions it grants as a list of permission strings such as project:view. Any member of the organization may read this.
Parameters
| Name | In | Type | Description |
|---|---|---|---|
orgId required | path | string (uuid) | The organization's id. |
Responses
| Status | Description | Body |
|---|---|---|
200 | The roles with their permissions. | RoleList |
401 | The token is missing, expired, revoked or of the wrong kind. | Error |
403 | orgId in the path is not the organization your token belongs to. | Error |
500 | A fault on our side. | Error |
Example
curl -X GET "https://api.spicelabs.io/api/v1/org/<orgId>/role" \
-H "Authorization: Bearer $SPICE_API_TOKEN"Get a role
GET /api/v1/org/{orgId}/role/{roleId}
Credentials: API token or dashboard sign-in.
One role, built in or the organization's own, with its id, name, whether it is built in (systemRole) and the permission strings it grants. Any member of the organization may read this.
Parameters
| Name | In | Type | Description |
|---|---|---|---|
orgId required | path | string (uuid) | The organization's id. |
roleId required | path | string (uuid) |
Responses
| Status | Description | Body |
|---|---|---|
200 | The role with its permissions. | Role |
401 | The token is missing, expired, revoked or of the wrong kind. | Error |
403 | The token is valid but not allowed to do this. | Error |
404 | No role with this id is a built-in role or belongs to this organization. | Error |
500 | A fault on our side. | Error |
Example
curl -X GET "https://api.spicelabs.io/api/v1/org/<orgId>/role/<roleId>" \
-H "Authorization: Bearer $SPICE_API_TOKEN"