> ## Documentation Index
> Fetch the complete documentation index at: https://docs.barndoor.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Get Organization Roles Groups

> Get all unique roles and groups across all users in the organization.

Returns aggregated lists of all roles and groups that are assigned
to any user in the authenticated user's organization.
Only users with permission to list users can access this endpoint.



## OpenAPI

````yaml /api-reference/openapi.yaml get /api/identity/public/v1/users/roles-groups
openapi: 3.1.0
info:
  title: Barndoor.ai Public API
  description: Unified public API specification for Barndoor.ai platform
  version: 2.18.0
servers:
  - url: https://{host}
    description: Barndoor public API
    variables:
      host:
        default: platform.barndoor.ai
        description: >-
          The host serving your Barndoor deployment. Defaults to production;
          override it for another environment or a dedicated deployment.
security:
  - ApiKey: []
  - OAuth2:
      - openid
      - profile
      - email
tags:
  - name: dlp
    x-group: Data Control Center
  - name: identity
    x-group: Identity
  - name: llm-gateway
    x-group: LLM Gateway
  - name: notification
    x-group: Notifications
  - name: policy
    x-group: Policies
  - name: registry
    x-group: MCP Gateway
  - name: system-management
    x-group: Log Exports
paths:
  /api/identity/public/v1/users/roles-groups:
    get:
      tags:
        - identity
      summary: Get Organization Roles Groups
      description: |-
        Get all unique roles and groups across all users in the organization.

        Returns aggregated lists of all roles and groups that are assigned
        to any user in the authenticated user's organization.
        Only users with permission to list users can access this endpoint.
      operationId: list_roles_and_groups
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OrganizationRolesGroupsResponse'
components:
  schemas:
    OrganizationRolesGroupsResponse:
      properties:
        roles:
          items:
            type: string
          type: array
          title: Roles
          description: >-
            Distinct role names assigned to at least one user in the
            organization. Unprefixed — use as `role:<name>` in a policy rule's
            `roles_groups`.
        groups:
          items:
            type: string
          type: array
          title: Groups
          description: >-
            Distinct group names assigned to at least one user in the
            organization. Unprefixed — use as `group:<name>` in a policy rule's
            `roles_groups`.
      type: object
      required:
        - roles
        - groups
      title: OrganizationRolesGroupsResponse
      description: >-
        Aggregated roles and groups for all users in an organization.


        These are the names a policy rule addresses through ``roles_groups``.
        The

        values here are UNPREFIXED; a policy rule requires the
        ``role:``/``group:``

        prefix (see ``PolicyRule.roles_groups`` in policy-service), so a value

        ``Engineering`` from ``groups`` is written as ``group:Engineering``.
  securitySchemes:
    ApiKey:
      type: http
      scheme: bearer
      description: >-
        A Barndoor API key, sent as `Authorization: Bearer <key>`. Keys are
        prefixed `bdai_` and are opaque — do not attempt to decode one.
        Interchangeable with an OAuth 2.0 access token.
    OAuth2:
      type: oauth2
      x-issuer: https://auth.barndoor.ai/realms/barndoor
      description: >-
        An OAuth 2.0 access token from Barndoor's identity provider, sent as
        `Authorization: Bearer <token>`. Public clients must use PKCE.
        Interchangeable with an API key.
      flows:
        authorizationCode:
          authorizationUrl: >-
            https://auth.barndoor.ai/realms/barndoor/protocol/openid-connect/auth
          tokenUrl: >-
            https://auth.barndoor.ai/realms/barndoor/protocol/openid-connect/token
          scopes:
            openid: Issue an OIDC ID token identifying the caller.
            profile: Read the caller's basic profile claims.
            email: Read the caller's email address.
            offline_access: Issue a refresh token. Optional — no operation requires it.
        clientCredentials:
          tokenUrl: >-
            https://auth.barndoor.ai/realms/barndoor/protocol/openid-connect/token
          scopes:
            openid: Issue an OIDC ID token identifying the caller.
            profile: Read the caller's basic profile claims.
            email: Read the caller's email address.
            offline_access: Issue a refresh token. Optional — no operation requires it.

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.