envless.roles.list_permissions()

def list_permissions(
    *,
    timeout: float | None = None,
) -> PermissionsResource

async def list_permissions(
    *,
    timeout: float | None = None,
) -> PermissionsResource

Returns the complete catalogue of permission strings the platform understands, the same catalogue grouped by resource in byResource, and the exact permission lists behind owner, admin and viewer in systemRoles. Read it before create or update so you only ever send names that exist.

Filter on assignableToCustomRoles when you build a picker: the False entries, workspace:delete and billing:manage, are refused for every custom role regardless of who asks. The catalogue is only the outer ceiling, the caller permission check still applies on top of it, so a list that passes validation can still be rejected with 403.

This response is not a collection and takes no list options. The pagination middleware accepts limit and offset on the route, but they have no effect, which is why the method only takes timeout=.

Example#

from envless import envless

catalogue = envless.roles.list_permissions()

assignable = [
    permission
    for permission in catalogue['permissions']
    if permission['assignableToCustomRoles']
]

print(list(catalogue['byResource']))
print(len(assignable), len(catalogue['systemRoles']['owner']))

import asyncio

from envless import AsyncEnvless


async def main() -> None:
    async with AsyncEnvless() as envless:
        catalogue = await envless.roles.list_permissions()

        assignable = [
            permission
            for permission in catalogue['permissions']
            if permission['assignableToCustomRoles']
        ]

        print(list(catalogue['byResource']))
        print(len(assignable), len(catalogue['systemRoles']['owner']))


asyncio.run(main())

Parameters#

Returns#

PermissionsResource with the flat permissions list, the byResource index and the systemRoles sets.

Worth knowing#

Required scopes#

roles:read

Underlying endpoint#

In TypeScript#