> ## Documentation Index > Fetch the complete documentation index at: https://docs.cloud.cdata.com/llms.txt > Use this file to discover all available pages before exploring further. # List User Roles > List all roles for a user, however inherited (direct, group-derived, or workspace-derived), across all of the user's workspaces. Includes both system and access role types. To list roles in a specific workspace only, use `GET /users/{id}/workspaces/{workspace_id}/roles`. ## OpenAPI ````yaml en/API/Management-API.yaml GET /users/{id}/roles openapi: 3.1.0 info: title: CData Connect AI Management API version: v1 description: > The Connect AI Management API provides programmatic control over enterprise platform administration. Base path: /api/v1/admin. Use it to manage users, service accounts, roles, and resource permissions without manual UI operations. The API follows OAS 3.0 standards with OAuth 2.0 scoped authentication. On versioning: the version prefix is incremented when breaking changes require it. A new /api/v2/admin path will be introduced with a 6-month deprecation notice before any v1 endpoint is retired. On human users vs. service accounts: human users are provisioned and lifecycle-managed by SCIM; the Management API handles direct overrides and atomic deprovisioning. Service accounts (CI/CD pipelines, IaC tooling, Terraform) are fully managed via the Management API and are not SCIM-owned. servers: - url: https://cloud.cdata.com/api/v1/admin description: Production base URL security: - oauth2: [] tags: - name: Users description: > Lifecycle management for human users: create, update, deprovision, and manage direct role assignments, workspace-scoped roles, and direct resource permissions. SCIM handles group-based provisioning and user creation at scale; this API handles direct overrides and atomic deprovisioning. - name: Service Accounts description: > Full lifecycle management for machine identities (CI/CD pipelines, IaC tooling, Terraform automation). Service accounts are not SCIM-owned and authenticate via OAuth 2.0 client credentials using the `client_id` returned on creation. paths: /users/{id}/roles: get: tags: - Users summary: List User Roles description: > List all roles for a user, however inherited (direct, group-derived, or workspace-derived), across all of the user's workspaces. Includes both system and access role types. To list roles in a specific workspace only, use `GET /users/{id}/workspaces/{workspace_id}/roles`. operationId: listUserRoles parameters: - name: id in: path required: true description: User identifier (UUID). schema: type: string format: uuid responses: '200': description: OK content: application/json: schema: $ref: '#/components/schemas/UserRoleCollection' example: items: - role_id: 00000000-0000-0000-0000-000000000010 role_name: Admin role_type: system_role grant_type: direct group_id: null group_name: null granted_at: '2026-06-01T12:00:00Z' - role_id: b2c3d4e5-f6a7-8901-bcde-f12345678901 role_name: Data Steward role_type: access_role grant_type: group_derived group_id: g1b2c3d4-e5f6-7890-abcd-ef1234567890 group_name: Finance granted_at: '2026-03-15T09:00:00Z' limit: 20 next_cursor: null '404': $ref: '#/components/responses/UserNotFound' security: - oauth2: - management:users:read components: schemas: UserRoleCollection: allOf: - $ref: '#/components/schemas/CollectionEnvelope' - type: object properties: items: type: array items: $ref: '#/components/schemas/UserRoleItem' CollectionEnvelope: type: object properties: limit: type: integer description: Maximum number of items per page as requested. next_cursor: type: string nullable: true description: >- Pagination cursor for the next page. null when no further pages exist. Total count is not returned. UserRoleItem: type: object description: > A role held by a user, with full provenance. Returned by GET /users/{id}/roles. properties: role_id: type: string format: uuid description: The role identifier. role_name: type: string description: The name of the role. role_type: type: string enum: - system_role - access_role description: The type of the role. grant_type: type: string enum: - direct - group_derived - workspace_derived description: > How this role was conferred. `direct`: assigned explicitly. `group_derived`: inherited via a group membership. `workspace_derived`: inherited via workspace configuration (placeholder term; exact name is subject to change). group_id: type: string format: uuid nullable: true description: >- Set for `grant_type: group_derived`: the group that conferred this role. null for direct grants. group_name: type: string nullable: true description: Group display name. null for direct grants. granted_at: type: string format: date-time description: ISO 8601 UTC. ErrorResponse: type: object properties: error: type: object description: Error details. properties: code: type: string description: SCREAMING_SNAKE_CASE error code. message: type: string description: Human-readable error description. responses: UserNotFound: description: Not Found content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' example: error: code: USER_NOT_FOUND message: The specified user does not exist. securitySchemes: oauth2: type: oauth2 flows: clientCredentials: tokenUrl: https://cloud-login.cdata.com/oauth/token scopes: management:users:read: Read access to user resources. management:users:write: Write access to user resources. management:service-accounts:read: Read access to service account resources. management:service-accounts:write: Write access to service account resources. ````