List role bindings | Cloud Control Plane API documentation

List role bindings Run in API Explorer

GET /v1/role-bindings

Auth0

List role assignments to organization users.

Query parameters

filter.role_name string
filter.account string
filter.scope.resource_type string

Values are SCOPE_RESOURCE_TYPE_RESOURCE_GROUP, SCOPE_RESOURCE_TYPE_NETWORK, SCOPE_RESOURCE_TYPE_CLUSTER, SCOPE_RESOURCE_TYPE_SERVERLESS_CLUSTER, SCOPE_RESOURCE_TYPE_NETWORK_PEERING, or SCOPE_RESOURCE_TYPE_ORGANIZATION.
filter.scope.resource_id string
filter.account_ids array[string]
page_size integer(int32)
page_token string

Responses

200 application/json

OK
Hide response attributes Show response attributes object
- next_page_token string
- role_bindings array[object]
  
  RoleBindings matching the request
  
  Not more than 100 elements.
  
  Hide role_bindings attributes Show role_bindings attributes object
  
  account_id string
  
  created_at string(date-time)
  
  id string
  
  role_name string
  
  scope object
  
  Hide scope attributes Show scope attributes object
  
  resource_id string
  
  resource_type string
  
  Values are SCOPE_RESOURCE_TYPE_RESOURCE_GROUP, SCOPE_RESOURCE_TYPE_NETWORK, SCOPE_RESOURCE_TYPE_CLUSTER, SCOPE_RESOURCE_TYPE_SERVERLESS_CLUSTER, SCOPE_RESOURCE_TYPE_NETWORK_PEERING, or SCOPE_RESOURCE_TYPE_ORGANIZATION.
  
  updated_at string(date-time)
500 application/json

Internal Server Error. Reach out to support.
Hide response attributes Show response attributes object
- code string(int32)
  
  RPC status code, as described here.
  
  Values are OK, CANCELLED, UNKNOWN, INVALID_ARGUMENT, DEADLINE_EXCEEDED, NOT_FOUND, ALREADY_EXISTS, PERMISSION_DENIED, UNAUTHENTICATED, RESOURCE_EXHAUSTED, FAILED_PRECONDITION, ABORTED, OUT_OF_RANGE, UNIMPLEMENTED, INTERNAL, UNAVAILABLE, or DATA_LOSS.
- details array[object]
  
  A list of messages that carries the error details.
  
  Details of the error.
  
  Details of the error.
  
  One of:
  BadRequest object ErrorInfo object QuotaFailure object Help object
  
  Describes violations in a client request. This error type focuses on the syntactic aspects of the request.
  
  Hide attributes Show attributes
  
  @type string
  
  Fully qualified protobuf type name of the underlying response, prefixed with type.googleapis.com/.
  
  Value is type.googleapis.com/google.rpc.BadRequest.
  
  field_violations array[object]
  
  Describes all violations in a client request.
  
  A message type used to describe a single bad request field.
  
  Hide field_violations attributes Show field_violations attributes object
  
  description string
  
  A description of why the request element is bad.
  
  field string
  
  A path that leads to a field in the request body. The value will be a sequence of dot-separated identifiers that identify a protocol buffer field.
  
  Consider the following:
  
  message CreateContactRequest { message EmailAddress { enum Type { TYPE_UNSPECIFIED = 0; HOME = 1; WORK = 2; }
  
  optional string email = 1; repeated EmailType type = 2; }
  
  string full_name = 1; repeated EmailAddress email_addresses = 2; }
  
  In this example, in proto field could take one of the following values:
  
  full_name for a violation in the full_name value
  
  email_addresses[1].email for a violation in the email field of the first email_addresses message
  
  email_addresses[3].type[2] for a violation in the second type value in the third email_addresses message.
  
  In JSON, the same values are represented as:
  
  fullName for a violation in the fullName value
  
  emailAddresses[1].email for a violation in the email field of the first emailAddresses message
  
  emailAddresses[3].type[2] for a violation in the second type value in the third emailAddresses message.
  
  localized_message object
  
  Provides a localized error message that is safe to return to the user which can be attached to an RPC error.
  
  Hide localized_message attributes Show localized_message attributes object
  
  locale string
  
  message string
  
  The localized error message in the above locale.
  
  reason string
  
  The reason of the field-level error. This is a constant value that identifies the proximate cause of the field-level error. It should uniquely identify the type of the FieldViolation within the scope of the google.rpc.ErrorInfo.domain. This should be at most 63 characters and match a regular expression of [A-Z][A-Z0-9_]+[A-Z0-9], which represents UPPER_SNAKE_CASE.
  
  Describes the cause of the error with structured details.
  
  Example of an error when contacting the "pubsub.googleapis.com" API when it is not enabled:
  
  { "reason": "API_DISABLED" "domain": "googleapis.com" "metadata": { "resource": "projects/123", "service": "pubsub.googleapis.com" } }
  
  This response indicates that the pubsub.googleapis.com API is not enabled.
  
  Example of an error that is returned when attempting to create a Spanner instance in a region that is out of stock:
  
  { "reason": "STOCKOUT" "domain": "spanner.googleapis.com", "metadata": { "availableRegions": "us-central1,us-east2" } }
  
  Hide attributes Show attributes
  
  @type string
  
  Fully qualified protobuf type name of the underlying response, prefixed with type.googleapis.com/.
  
  Value is type.googleapis.com/google.rpc.ErrorInfo.
  
  domain string
  
  The logical grouping to which the "reason" belongs. The error domain is typically the registered service name of the tool or product that generates the error. Example: "pubsub.googleapis.com". If the error is generated by some common infrastructure, the error domain must be a globally unique value that identifies the infrastructure. For Google API infrastructure, the error domain is "googleapis.com".
  
  metadata object
  
  Additional structured details about this error.
  
  Keys must match a regular expression of [a-z][a-zA-Z0-9-_]+ but should ideally be lowerCamelCase. Also, they must be limited to 64 characters in length. When identifying the current value of an exceeded limit, the units should be contained in the key, not the value. For example, rather than {"instanceLimit": "100/request"}, should be returned as, {"instanceLimitPerRequest": "100"}, if the client exceeds the number of instances that can be created in a single (batch) request.
  
  Hide metadata attribute Show metadata attribute object
  
  * string Additional properties
  
  reason string
  
  The reason of the error. This is a constant value that identifies the proximate cause of the error. Error reasons are unique within a particular domain of errors. This should be at most 63 characters and match a regular expression of [A-Z][A-Z0-9_]+[A-Z0-9], which represents UPPER_SNAKE_CASE.
  
  Describes how a quota check failed.
  
  For example if a daily limit was exceeded for the calling project, a service could respond with a QuotaFailure detail containing the project id and the description of the quota limit that was exceeded. If the calling project hasn't enabled the service in the developer console, then a service could respond with the project id and set service_disabled to true.
  
  Also see RetryInfo and Help types for other details about handling a quota failure.
  
  Hide attributes Show attributes
  
  @type string
  
  Fully qualified protobuf type name of the underlying response, prefixed with type.googleapis.com/.
  
  Value is type.googleapis.com/google.rpc.QuotaFailure.
  
  violations array[object]
  
  Describes all quota violations.
  
  A message type used to describe a single quota violation. For example, a daily quota or a custom quota that was exceeded.
  
  Hide violations attributes Show violations attributes object
  
  api_service string
  
  The API Service from which the QuotaFailure.Violation orginates. In some cases, Quota issues originate from an API Service other than the one that was called. In other words, a dependency of the called API Service could be the cause of the QuotaFailure, and this field would have the dependency API service name.
  
  For example, if the called API is Kubernetes Engine API (container.googleapis.com), and a quota violation occurs in the Kubernetes Engine API itself, this field would be "container.googleapis.com". On the other hand, if the quota violation occurs when the Kubernetes Engine API creates VMs in the Compute Engine API (compute.googleapis.com), this field would be "compute.googleapis.com".
  
  description string
  
  A description of how the quota check failed. Clients can use this description to find more about the quota configuration in the service's public documentation, or find the relevant quota limit to adjust through developer console.
  
  For example: "Service disabled" or "Daily Limit for read operations exceeded".
  
  future_quota_value string(int64) | null
  
  The new quota value being rolled out at the time of the violation. At the completion of the rollout, this value will be enforced in place of quota_value. If no rollout is in progress at the time of the violation, this field is not set.
  
  For example, if at the time of the violation a rollout is in progress changing the number of CPUs quota from 10 to 20, 20 would be the value of this field.
  
  quota_dimensions object
  
  The dimensions of the violated quota. Every non-global quota is enforced on a set of dimensions. While quota metric defines what to count, the dimensions specify for what aspects the counter should be increased.
  
  For example, the quota "CPUs per region per VM family" enforces a limit on the metric "compute.googleapis.com/cpus_per_vm_family" on dimensions "region" and "vm_family". And if the violation occurred in region "us-central1" and for VM family "n1", the quota_dimensions would be,
  
  { "region": "us-central1", "vm_family": "n1", }
  
  When a quota is enforced globally, the quota_dimensions would always be empty.
  
  Hide quota_dimensions attribute Show quota_dimensions attribute object
  
  * string Additional properties
  
  quota_id string
  
  The id of the violated quota. Also know as "limit name", this is the unique identifier of a quota in the context of an API service.
  
  For example, "CPUS-PER-VM-FAMILY-per-project-region".
  
  quota_metric string
  
  The metric of the violated quota. A quota metric is a named counter to measure usage, such as API requests or CPUs. When an activity occurs in a service, such as Virtual Machine allocation, one or more quota metrics may be affected.
  
  For example, "compute.googleapis.com/cpus_per_vm_family", "storage.googleapis.com/internet_egress_bandwidth".
  
  quota_value string(int64)
  
  The enforced quota value at the time of the QuotaFailure.
  
  For example, if the enforced quota value at the time of the QuotaFailure on the number of CPUs is "10", then the value of this field would reflect this quantity.
  
  subject string
  
  The subject on which the quota check failed. For example, "clientip:" or "project:".
  
  Provides links to documentation or for performing an out of band action.
  
  For example, if a quota check failed with an error indicating the calling project hasn't enabled the accessed service, this can contain a URL pointing directly to the right place in the developer console to flip the bit.
  
  Hide attributes Show attributes
  
  @type string
  
  Fully qualified protobuf type name of the underlying response, prefixed with type.googleapis.com/.
  
  Value is type.googleapis.com/google.rpc.Help.
  
  links array[object]
  
  URL(s) pointing to additional information on handling the current error.
  
  Describes a URL link.
  
  Hide links attributes Show links attributes object
  
  description string
  
  Describes what the link offers.
  
  url string
  
  The URL of the link.
- message string
  
  Detailed error message. No compatibility guarantees are given for the text contained in this message.
default application/json

An unexpected error response.
Hide response attributes Show response attributes object
- code string(int32)
  
  RPC status code, as described here.
  
  Values are OK, CANCELLED, UNKNOWN, INVALID_ARGUMENT, DEADLINE_EXCEEDED, NOT_FOUND, ALREADY_EXISTS, PERMISSION_DENIED, UNAUTHENTICATED, RESOURCE_EXHAUSTED, FAILED_PRECONDITION, ABORTED, OUT_OF_RANGE, UNIMPLEMENTED, INTERNAL, UNAVAILABLE, or DATA_LOSS.
- details array[object]
  
  A list of messages that carries the error details.
  
  Details of the error.
  
  Details of the error.
  
  One of:
  BadRequest object ErrorInfo object QuotaFailure object Help object
  
  Describes violations in a client request. This error type focuses on the syntactic aspects of the request.
  
  Hide attributes Show attributes
  
  @type string
  
  Fully qualified protobuf type name of the underlying response, prefixed with type.googleapis.com/.
  
  Value is type.googleapis.com/google.rpc.BadRequest.
  
  field_violations array[object]
  
  Describes all violations in a client request.
  
  A message type used to describe a single bad request field.
  
  Hide field_violations attributes Show field_violations attributes object
  
  description string
  
  A description of why the request element is bad.
  
  field string
  
  A path that leads to a field in the request body. The value will be a sequence of dot-separated identifiers that identify a protocol buffer field.
  
  Consider the following:
  
  message CreateContactRequest { message EmailAddress { enum Type { TYPE_UNSPECIFIED = 0; HOME = 1; WORK = 2; }
  
  optional string email = 1; repeated EmailType type = 2; }
  
  string full_name = 1; repeated EmailAddress email_addresses = 2; }
  
  In this example, in proto field could take one of the following values:
  
  full_name for a violation in the full_name value
  
  email_addresses[1].email for a violation in the email field of the first email_addresses message
  
  email_addresses[3].type[2] for a violation in the second type value in the third email_addresses message.
  
  In JSON, the same values are represented as:
  
  fullName for a violation in the fullName value
  
  emailAddresses[1].email for a violation in the email field of the first emailAddresses message
  
  emailAddresses[3].type[2] for a violation in the second type value in the third emailAddresses message.
  
  localized_message object
  
  Provides a localized error message that is safe to return to the user which can be attached to an RPC error.
  
  Hide localized_message attributes Show localized_message attributes object
  
  locale string
  
  message string
  
  The localized error message in the above locale.
  
  reason string
  
  The reason of the field-level error. This is a constant value that identifies the proximate cause of the field-level error. It should uniquely identify the type of the FieldViolation within the scope of the google.rpc.ErrorInfo.domain. This should be at most 63 characters and match a regular expression of [A-Z][A-Z0-9_]+[A-Z0-9], which represents UPPER_SNAKE_CASE.
  
  Describes the cause of the error with structured details.
  
  Example of an error when contacting the "pubsub.googleapis.com" API when it is not enabled:
  
  { "reason": "API_DISABLED" "domain": "googleapis.com" "metadata": { "resource": "projects/123", "service": "pubsub.googleapis.com" } }
  
  This response indicates that the pubsub.googleapis.com API is not enabled.
  
  Example of an error that is returned when attempting to create a Spanner instance in a region that is out of stock:
  
  { "reason": "STOCKOUT" "domain": "spanner.googleapis.com", "metadata": { "availableRegions": "us-central1,us-east2" } }
  
  Hide attributes Show attributes
  
  @type string
  
  Fully qualified protobuf type name of the underlying response, prefixed with type.googleapis.com/.
  
  Value is type.googleapis.com/google.rpc.ErrorInfo.
  
  domain string
  
  The logical grouping to which the "reason" belongs. The error domain is typically the registered service name of the tool or product that generates the error. Example: "pubsub.googleapis.com". If the error is generated by some common infrastructure, the error domain must be a globally unique value that identifies the infrastructure. For Google API infrastructure, the error domain is "googleapis.com".
  
  metadata object
  
  Additional structured details about this error.
  
  Keys must match a regular expression of [a-z][a-zA-Z0-9-_]+ but should ideally be lowerCamelCase. Also, they must be limited to 64 characters in length. When identifying the current value of an exceeded limit, the units should be contained in the key, not the value. For example, rather than {"instanceLimit": "100/request"}, should be returned as, {"instanceLimitPerRequest": "100"}, if the client exceeds the number of instances that can be created in a single (batch) request.
  
  Hide metadata attribute Show metadata attribute object
  
  * string Additional properties
  
  reason string
  
  The reason of the error. This is a constant value that identifies the proximate cause of the error. Error reasons are unique within a particular domain of errors. This should be at most 63 characters and match a regular expression of [A-Z][A-Z0-9_]+[A-Z0-9], which represents UPPER_SNAKE_CASE.
  
  Describes how a quota check failed.
  
  For example if a daily limit was exceeded for the calling project, a service could respond with a QuotaFailure detail containing the project id and the description of the quota limit that was exceeded. If the calling project hasn't enabled the service in the developer console, then a service could respond with the project id and set service_disabled to true.
  
  Also see RetryInfo and Help types for other details about handling a quota failure.
  
  Hide attributes Show attributes
  
  @type string
  
  Fully qualified protobuf type name of the underlying response, prefixed with type.googleapis.com/.
  
  Value is type.googleapis.com/google.rpc.QuotaFailure.
  
  violations array[object]
  
  Describes all quota violations.
  
  A message type used to describe a single quota violation. For example, a daily quota or a custom quota that was exceeded.
  
  Hide violations attributes Show violations attributes object
  
  api_service string
  
  The API Service from which the QuotaFailure.Violation orginates. In some cases, Quota issues originate from an API Service other than the one that was called. In other words, a dependency of the called API Service could be the cause of the QuotaFailure, and this field would have the dependency API service name.
  
  For example, if the called API is Kubernetes Engine API (container.googleapis.com), and a quota violation occurs in the Kubernetes Engine API itself, this field would be "container.googleapis.com". On the other hand, if the quota violation occurs when the Kubernetes Engine API creates VMs in the Compute Engine API (compute.googleapis.com), this field would be "compute.googleapis.com".
  
  description string
  
  A description of how the quota check failed. Clients can use this description to find more about the quota configuration in the service's public documentation, or find the relevant quota limit to adjust through developer console.
  
  For example: "Service disabled" or "Daily Limit for read operations exceeded".
  
  future_quota_value string(int64) | null
  
  The new quota value being rolled out at the time of the violation. At the completion of the rollout, this value will be enforced in place of quota_value. If no rollout is in progress at the time of the violation, this field is not set.
  
  For example, if at the time of the violation a rollout is in progress changing the number of CPUs quota from 10 to 20, 20 would be the value of this field.
  
  quota_dimensions object
  
  The dimensions of the violated quota. Every non-global quota is enforced on a set of dimensions. While quota metric defines what to count, the dimensions specify for what aspects the counter should be increased.
  
  For example, the quota "CPUs per region per VM family" enforces a limit on the metric "compute.googleapis.com/cpus_per_vm_family" on dimensions "region" and "vm_family". And if the violation occurred in region "us-central1" and for VM family "n1", the quota_dimensions would be,
  
  { "region": "us-central1", "vm_family": "n1", }
  
  When a quota is enforced globally, the quota_dimensions would always be empty.
  
  Hide quota_dimensions attribute Show quota_dimensions attribute object
  
  * string Additional properties
  
  quota_id string
  
  The id of the violated quota. Also know as "limit name", this is the unique identifier of a quota in the context of an API service.
  
  For example, "CPUS-PER-VM-FAMILY-per-project-region".
  
  quota_metric string
  
  The metric of the violated quota. A quota metric is a named counter to measure usage, such as API requests or CPUs. When an activity occurs in a service, such as Virtual Machine allocation, one or more quota metrics may be affected.
  
  For example, "compute.googleapis.com/cpus_per_vm_family", "storage.googleapis.com/internet_egress_bandwidth".
  
  quota_value string(int64)
  
  The enforced quota value at the time of the QuotaFailure.
  
  For example, if the enforced quota value at the time of the QuotaFailure on the number of CPUs is "10", then the value of this field would reflect this quantity.
  
  subject string
  
  The subject on which the quota check failed. For example, "clientip:" or "project:".
  
  Provides links to documentation or for performing an out of band action.
  
  For example, if a quota check failed with an error indicating the calling project hasn't enabled the accessed service, this can contain a URL pointing directly to the right place in the developer console to flip the bit.
  
  Hide attributes Show attributes
  
  @type string
  
  Fully qualified protobuf type name of the underlying response, prefixed with type.googleapis.com/.
  
  Value is type.googleapis.com/google.rpc.Help.
  
  links array[object]
  
  URL(s) pointing to additional information on handling the current error.
  
  Describes a URL link.
  
  Hide links attributes Show links attributes object
  
  description string
  
  Describes what the link offers.
  
  url string
  
  The URL of the link.
- message string
  
  Detailed error message. No compatibility guarantees are given for the text contained in this message.

GET /v1/role-bindings

curl \
 --request GET 'https://api.redpanda.com/v1/role-bindings' \
 --header "Authorization: Bearer $ACCESS_TOKEN"

Response examples (200)

{
  "next_page_token": "string",
  "role_bindings": [
    {
      "account_id": "string",
      "created_at": "2025-05-04T09:42:00Z",
      "id": "string",
      "role_name": "string",
      "scope": {
        "resource_id": "string",
        "resource_type": "SCOPE_RESOURCE_TYPE_RESOURCE_GROUP"
      },
      "updated_at": "2025-05-04T09:42:00Z"
    }
  ]
}

Response examples (500)

{
  "code": "OK",
  "details": [
    {
      "@type": "type.googleapis.com/google.rpc.BadRequest",
      "field_violations": [
        {
          "description": "string",
          "field": "string",
          "localized_message": {
            "locale": "string",
            "message": "string"
          },
          "reason": "string"
        }
      ]
    }
  ],
  "message": "string"
}

Response examples (default)

{
  "code": "OK",
  "details": [
    {
      "@type": "type.googleapis.com/google.rpc.BadRequest",
      "field_violations": [
        {
          "description": "string",
          "field": "string",
          "localized_message": {
            "locale": "string",
            "message": "string"
          },
          "reason": "string"
        }
      ]
    }
  ],
  "message": "string"
}