Skip to main content

Role

A tenant (organization) role: either a predefined platform role (admin/viewer) or a custom role defined by an organization admin.

type Role {
  name: String!
  title: String!
  description: String!
  patterns: [String!]!
  grantsAt: [String!]!
  predefined: Boolean!
}

Fields​

Role.name ● String! non-null scalar​

The role's unique name within the tenant (URL-safe identifier).

Role.title ● String! non-null scalar​

Human-readable title.

Role.description ● String! non-null scalar​

Optional description of what the role is for.

Role.patterns ● [String!]! non-null scalar​

RE2 authorization patterns this role grants. A scope is granted iff any pattern fullmatches it; a concrete pick (e.g. "workspace__strategy__write") is a literal pattern matching itself. Stamped verbatim as the role subgroup's scopePatterns.

Role.grantsAt ● [String!]! non-null scalar​

Tenancy levels at which this role grants access (e.g. "workspace").

Role.predefined ● Boolean! non-null scalar​

True for the built-in admin/viewer roles, which cannot be edited or deleted as custom roles (but can still be assigned to members).

Returned By​

createRole mutation ● roles query ● updateRole mutation