Roles

The role object

A named set of permissions that can be assigned to users to control what they can access.

idstring

Role ID.

objectstringenumValues:role

Resource type identifier.

namestring

Display name, unique within the account.

typestringenumValues:adminuserscanner

The kind of role.

The role's type is sometimes used to gate special behaviors and to restrict some actions to only certain types of roles. For example, only roles with the type admin can create and manage API keys.

admin: full administrative access, including managing API keys.
user: a custom role tailored to a specific need (its permissions are defined explicitly). Roles created through the API always have this type.
scanner: a role for scanning-station operators.
sales_rep: a role for sales representatives.
agent: a role assigned to an automated agent rather than a person.

ownerownernullable

Provenance of this role.

System-owned roles are global defaults shared across all accounts and cannot be modified or deleted; account-owned roles are custom roles created by that account.

objectstringenumValues:owner

Resource type identifier.

typestringenumValues:systemaccount

Where this resource came from.

system: a platform-provided default shared across all accounts; not editable.
account: created and owned by a specific account; the account field identifies which.

accountaccountnullable

The account that owns this resource.

Present only when type is account; system-owned resources have no owning account.

idstring

Account ID.

objectstringenumValues:account

Resource type identifier.

namestring

The account's display name.

default_billing_addressaddressnullable

Default billing address.

Always returned as null in this endpoint.

default_shipping_addressaddressnullable

Default shipping address.

Always returned as null in this endpoint.

brandingaccount_brandingnullable

Customer-facing branding for the account, such as the logo, support contacts, and social links.

Always returned as null in this endpoint.

portalaccount_portalnullable

The account's customer portal settings, including the portal URL slug.

Always returned as null in this endpoint.

created_atstring (date-time)

Creation timestamp.

updated_atstring (date-time)

Last updated timestamp.

permissionsarray of stringnullable

Permissions granted by this role, in {domain}:{action} format, such as customers:read.

created_atstring (date-time)

Creation timestamp.

updated_atstring (date-time)

Last updated timestamp.

Used by

role example

{
  "id": "rl_01c16d2eb637c0d1f3a372937c",
  "object": "role",
  "name": "Admin",
  "type": "admin",
  "owner": {
    "object": "owner",
    "type": "account",
    "account": {
      "id": "ac_01148680966698341a9c0976db",
      "object": "account",
      "name": "Acme Inc.",
      "default_billing_address": null,
      "default_shipping_address": null,
      "branding": null,
      "portal": null,
      "created_at": "2026-05-10T00:00:00Z",
      "updated_at": "2026-05-10T00:23:00Z"
    }
  },
  "permissions": [
    "customers:create",
    "customers:read",
    "customers:update",
    "customers:delete"
  ],
  "created_at": "2026-05-10T00:00:00Z",
  "updated_at": "2026-05-10T00:23:00Z"
}

{
  "id": "rl_01c16d2eb637c0d1f3a372937c",
  "object": "role",
  "name": "Admin",
  "type": "admin",
  "owner": {
    "object": "owner",
    "type": "account",
    "account": {
      "id": "ac_01148680966698341a9c0976db",
      "object": "account",
      "name": "Acme Inc.",
      "default_billing_address": null,
      "default_shipping_address": null,
      "branding": null,
      "portal": null,
      "created_at": "2026-05-10T00:00:00Z",
      "updated_at": "2026-05-10T00:23:00Z"
    }
  },
  "permissions": [
    "customers:create",
    "customers:read",
    "customers:update",
    "customers:delete"
  ],
  "created_at": "2026-05-10T00:00:00Z",
  "updated_at": "2026-05-10T00:23:00Z"
}

Roles

Attributes

Used by