RoleResponse

Response schema for a single role

data objectrequired

This is an object representing a role in the system.

denied_permissionsstring[]required

Permissions explicitly denied for this role. Denials win over grants, including wildcards (e.g. denying appointments.own.cancel removes cancel even when the role has appointments.own.*). Superuser roles cannot have denials.

idstringrequired

Unique identifier for the role.

Possible values: Value must match regular expression ^role_\w{12}$

namestringrequired

The name of the role.

objectstringrequired

String representing the object's type.

Possible values: [role]

permissionsstring[]required

Granted permissions for this role. Built-in roles return their baseline grants; custom roles return the stored allow-list. Explicit denials are listed separately in denied_permissions and always win over grants (including wildcards).

typestringrequired

The type of the role.

Possible values: [admin, staff, superuser, custom]

RoleResponse

{
  "data": {
    "denied_permissions": [
      "appointments.own.cancel",
      "appointments.own.reschedule"
    ],
    "id": "role_123456789012",
    "name": "Staff",
    "object": "role",
    "permissions": [
      "accounts.view",
      "appointments.own.*",
      "blocks.*",
      "booking_intents.*",
      "clients.*",
      "integrations.own.*",
      "providers.own.view",
      "providers.own.update"
    ],
    "type": "staff"
  }
}