Current plan level (Free, Team, Business, or Enterprise: Retool | Pricing): Team (exploring via internal APIs)
Monthly/Annual (if Team or Business):
Version of Retool (if self-hosted):
Question / Description:
What I see: GET /api/v2/roles returns only organization roles — every one has isObjectRole: false, a populated organizationScopes array, and an empty objectScopes: . Example:
The gap: When I read roleGrants (on users/groups), I see a different set of roleIds that are never returned by GET /api/v2/roles — the ones that grant access to apps/workflows/resources/agents. e.g. a grant like:
By cross-referencing the object's access list I can tell corresponds to an Own (or Edit/Use) access level, and the same roleId is reused across many objects/groups. There are also objectId: null variants that appear to mean "all apps" / "all workflows" / "all resources" / etc.
My questions:
Is there an API to enumerate these object-access roles? GET /api/v2/roles excludes them. Is there a filter/param (e.g. for isObjectRole: true), or a separate endpoint?
Are these object-role roleId UUIDs stable across organizations/Spaces, or are they per-org? I need to know whether I can rely on a fixed mapping or must resolve them per-org at runtime.
What is objectScopes, and how do I get a role where it's populated? It's empty on every org role I have. What scope strings live there for object roles (e.g. apps:use?)?
What's the canonical way to resolve a roleGrant.roleId → its access level (Use/Edit/Own)? Right now I'm joining each grant against the object's access-list endpoint to read the accessLevel label. Is there a more direct mapping?
For the objectId: null "All-*" grants — how do I programmatically determine which object type each one covers (apps vs workflows vs resources vs agents)?
Trying to reconstruct effective access programmatically, so any pointer to the intended API path here would help. Thanks!
Thanks for reaching out, @Harshita_Agrawal! If I understand correctly, you're investigating the payload of internal API requests via the browser dev tools - is that right? The information that you're looking for is canonically available via our published API endpoints, but many of those are restricted to Enterprise plans.
I'll take a shot at answering your specific questions, but can you give me a little more context about what you're trying to accomplish?
No, not specifically - in order to read effective object access, query it per object with GET /api/v2/permissions/accessList/{objectType}/{objectId} or per subject with POST /api/v2/permissions/listObjects.
No, I believe object-level role UUIDs are generated independently for each organization.
Object roles are specifically filtered out of responses sent to the frontend, but one example of a valid scope is apps_access:edit.
This can't be reliably done via the /roles endpoint. See my answer to #1 for alternatives.
For these universal grants, the type is stored on the corresponding role as a organization scope - something like universal_apps_access:edit.
Hey, Thanks for sharing this Darren.
A follow up question:
GET /api/v2/permissions/accessList/{objectType}/{objectId}
This API gives us the effective permission of a subject(user/group) for the object, not all the configured permissions. Is there a way to get the configured permissions as well?
Suppose User has a direct binding (use) to an app
As well as binding through a group (edit) to the same app.
In that case, in the accessList API, we actually get the effective permission for the user (edit), where sources is the group.
Now, when I remove the user from the group, I will assume that the user loses access to the app.
But as there is a direct ‘use’ binding to the app, that suddenly appears.
So is there a way to get all bindings of the subject to an object via API - not just the effective ones?
I'm not aware of an endpoint that currently does this, unfortunately. I'll check internally for an existing feature request and create one on your behalf if it doesn't already exist!