curl --request GET \
--url https://{region}.api.plerion.com/v1/organization/roles \
--header 'Authorization: Bearer <token>'import requests
url = "https://{region}.api.plerion.com/v1/organization/roles"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://{region}.api.plerion.com/v1/organization/roles', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://{region}.api.plerion.com/v1/organization/roles",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://{region}.api.plerion.com/v1/organization/roles"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://{region}.api.plerion.com/v1/organization/roles")
.header("Authorization", "Bearer <token>")
.asString();require 'uri'
require 'net/http'
url = URI("https://{region}.api.plerion.com/v1/organization/roles")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'
response = http.request(request)
puts response.read_body{
"data": [
{
"id": "f68ed9a1-8eb4-443a-8ceb-203fa3d0bc4e",
"name": "Organization admin",
"description": "Full administration of the organization and every tenant. Superset of Tenant admin.",
"scope": "organization",
"permissions": [
{
"actions": [
"*"
]
}
],
"builtIn": true
},
{
"id": "31fd6afb-8d68-495a-98f2-fb0c0e455493",
"name": "Tenant read-only",
"description": "Read-only access within assigned tenants",
"scope": "tenant",
"permissions": [
{
"actions": [
"Finding:Read",
"Alert:Read",
"Asset:Read"
]
}
],
"builtIn": true
},
{
"id": "3f2a9c1e-5b7d-4e8a-9c21-7d4e5f6a8b90",
"organizationId": "7c9a1b2e-3d4f-4a5b-8c6d-9e0f1a2b3c4d",
"scope": "tenant",
"tenantId": "9d0e1f2a-3b4c-4d5e-8f7a-8b9c0d1e2f3a",
"name": "Finding triage",
"description": "Triage findings on the production accounts",
"permissions": [
{
"actions": [
"Finding:Read",
"Finding:Triage"
],
"resources": [
"e1f2a3b4-c5d6-4e7f-8a9b-0c1d2e3f4a5b"
]
},
{
"actionGroup": "read-only",
"resources": "*"
}
],
"createdAt": "2026-09-10T04:12:00.000Z",
"updatedAt": "2026-09-15T09:31:00.000Z",
"createdBy": "60f1a2b3c4d5e6f7a8b9c0d1",
"updatedBy": "9f8e7d6c-5b4a-4c3d-8e2f-1a0b9c8d7e6f",
"builtIn": false
}
],
"meta": {
"cursor": null
}
}{
"errors": [
{
"code": "InvalidCursor",
"message": "cursor is not one this list issued; pass meta.cursor from the previous page"
}
]
}{
"errors": [
{
"code": "<string>",
"message": "<string>",
"field": "<string>"
}
]
}{
"errors": [
{
"code": "<string>",
"message": "<string>",
"field": "<string>"
}
]
}List roles
Returns the built-in roles followed by the organization’s custom roles, each tagged builtIn. Built-in roles carry their permissions derived from the catalog; Organization admin is published as the * action. Filter by scope, and by tenantId for tenant-scoped custom roles. Page with cursor and perPage: perPage bounds the custom roles, the built-in roles appear on the first page only, and a cursor this list did not issue answers 400 InvalidCursor.
curl --request GET \
--url https://{region}.api.plerion.com/v1/organization/roles \
--header 'Authorization: Bearer <token>'import requests
url = "https://{region}.api.plerion.com/v1/organization/roles"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://{region}.api.plerion.com/v1/organization/roles', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://{region}.api.plerion.com/v1/organization/roles",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://{region}.api.plerion.com/v1/organization/roles"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://{region}.api.plerion.com/v1/organization/roles")
.header("Authorization", "Bearer <token>")
.asString();require 'uri'
require 'net/http'
url = URI("https://{region}.api.plerion.com/v1/organization/roles")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'
response = http.request(request)
puts response.read_body{
"data": [
{
"id": "f68ed9a1-8eb4-443a-8ceb-203fa3d0bc4e",
"name": "Organization admin",
"description": "Full administration of the organization and every tenant. Superset of Tenant admin.",
"scope": "organization",
"permissions": [
{
"actions": [
"*"
]
}
],
"builtIn": true
},
{
"id": "31fd6afb-8d68-495a-98f2-fb0c0e455493",
"name": "Tenant read-only",
"description": "Read-only access within assigned tenants",
"scope": "tenant",
"permissions": [
{
"actions": [
"Finding:Read",
"Alert:Read",
"Asset:Read"
]
}
],
"builtIn": true
},
{
"id": "3f2a9c1e-5b7d-4e8a-9c21-7d4e5f6a8b90",
"organizationId": "7c9a1b2e-3d4f-4a5b-8c6d-9e0f1a2b3c4d",
"scope": "tenant",
"tenantId": "9d0e1f2a-3b4c-4d5e-8f7a-8b9c0d1e2f3a",
"name": "Finding triage",
"description": "Triage findings on the production accounts",
"permissions": [
{
"actions": [
"Finding:Read",
"Finding:Triage"
],
"resources": [
"e1f2a3b4-c5d6-4e7f-8a9b-0c1d2e3f4a5b"
]
},
{
"actionGroup": "read-only",
"resources": "*"
}
],
"createdAt": "2026-09-10T04:12:00.000Z",
"updatedAt": "2026-09-15T09:31:00.000Z",
"createdBy": "60f1a2b3c4d5e6f7a8b9c0d1",
"updatedBy": "9f8e7d6c-5b4a-4c3d-8e2f-1a0b9c8d7e6f",
"builtIn": false
}
],
"meta": {
"cursor": null
}
}{
"errors": [
{
"code": "InvalidCursor",
"message": "cursor is not one this list issued; pass meta.cursor from the previous page"
}
]
}{
"errors": [
{
"code": "<string>",
"message": "<string>",
"field": "<string>"
}
]
}{
"errors": [
{
"code": "<string>",
"message": "<string>",
"field": "<string>"
}
]
}Authorizations
Plerion organization API key (plerion_oak_…), created by an organization admin in the Plerion app. GET operations work with a key of either access level; POST, PUT and DELETE require the readWrite access level.
Query Parameters
Return only roles of this scope.
organization, tenant Return only custom roles bound to this tenant.
The meta.cursor value from the previous page, passed back unchanged. Cursors are opaque and URL-safe.
Items per page, 1 to 1000.
^[1-9][0-9]{0,2}$|^1000$Was this page helpful?