> This page is for API. > For clean Markdown of any page, append .md to the page URL. > For a complete documentation index, see https://docs.eon.io/llms.txt. > For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.eon.io/_mcp/server. # List Roles POST https://%7Baccount-domain%7D.console.eon.io/api/v1/roles/list Retrieves a list of user roles. Reference: https://docs.eon.io/api/api-reference/access-management/roles/list-roles ## Authentication - `Authorization` header (bearer token, required) — Bearer authentication of the form `Bearer `, where token is your auth token. ## Request ### Query parameters - `pageToken` (string, optional) — Cursor that points to the first record of the next page of results. Get this value from the previous response. To preserve the results in the same order, use the same sorting and filters in the first request as all subsequent requests. - `pageSize` (integer, optional, default: 50) — Maximum number of items to return in the response. ## Response ### 200 Roles retrieved. - `roles` (list of Role, required) - `totalCount` (integer, optional) — Total number of roles. - `nextToken` (string, optional) — Cursor that points to the first record of the next page of results. Pass this value in the next request. ## Types ### Role Role. - `id` (string, required) — Role ID. - `name` (string, required) — Role display name. - `isBuiltInRole` (boolean, required) — Whether the role is a default role. If `true`, the role is a default role provided by Eon and can't be modified or deleted. If `false`, the role is a custom, user-created role. - `permissionGrants` (list of PermissionGrant, required) — List of permissions granted by the role. - `accessConditions` (list of AccessCondition, optional) — Sets of access conditions that restrict the resources a permission is granted for. IDs are set by you and are applied to the relevant permission in `permissionGrants`. An access condition can be applied to more than one permission grant. - `restoreDestinationLimits` (RestoreDestinationLimits, optional) — Limits the restore accounts that can be used as restore destinations for operations granted by the role. ### PermissionGrant - `permission` (enum, required) — User permission. - Allowed values: `permission_id_unspecified`, `global_settings.view`, `vault_accounts.manage`, `cost_explorer.view`, `user_access.manage`, `saml_group_access.manage`, `api_credentials.manage`, `api_credentials.rotate_secret`, `custom_roles.manage`, `dashboard.view`, `inventory.view`, `jobs.view`, `audit_logs.view`, `backup_settings.view`, `storage_gateway.view`, `database_explorer.search`, `file_explorer.search`, `snapshots.take_or_convert`, `resources.restore`, `configuration.validate`, `files.restore`, `databases.query`, `data_classes.override`, `environments.override`, `detected_apps.override`, `network_classification.override`, `control_violations.mute`, `backup_exclusion.manage`, `vaults.manage`, `source_accounts.manage`, `restore_accounts.manage`, `backup_policies.manage`, `discovery_configuration.manage`, `backup_configuration.manage`, `controls.manage`, `ransomware_detection.manage`, `notification_policies.manage`, `storage_gateway.manage`, `oauth_apps.manage`, `file_explorer.delete`, `storage_gateway_data.download`, `storage_gateway_metadata.view`, `data_catalog.view`, `discovery.trigger` - `accessConditionId` (string, optional) — If present, the ID of the set of access conditions that restrict the resources the permission is granted for. The ID must be present in an entry in `accessConditions`, and the permission itself must support access conditions. If omitted, the permission is granted for all resources. ### AccessCondition - `id` (string, required) — Display name for the data access rule, which also serves as its ID for use in `permissionGrants`. Valid characters: `[a-zA-Z0-9-_.\s]`. - `effect` (enum, required) — Whether the data access condition is an allowlist or blocklist. - Allowed values: `INCLUSIVE`, `EXCLUSIVE` - `expression` (AccessConditionalExpression, required) — Conditional expression to evaluate to determine which resources are accessible. Only one of the expressions below can be used. For multiple conditions using `AND` or `OR` logic, group expressions with `group`. You can nest multiple groups to create more complex expressions. ### RestoreDestinationLimits Limits the restore accounts that can be used as restore destinations for operations granted by the role. - `effect` (enum, required) — Whether the data access condition is an allowlist or blocklist. - Allowed values: `INCLUSIVE`, `EXCLUSIVE` - `restoreAccountProviderIds` (list of string, required) — List of cloud-provider-assigned restore account IDs to match against. ### AccessConditionalExpression Conditional expression to evaluate to determine which resources are accessible. Only one of the expressions below can be used. For multiple conditions using `AND` or `OR` logic, group expressions with `group`. You can nest multiple groups to create more complex expressions. - `group` (RoleAccessGroupCondition, optional) — Group of expressions to evaluate using the logical operator specified in `operator`. Each item in the `operands` list can be either a single expression or a nested `group` expression. - `resourceType` (ResourceTypeCondition, optional) - `dataClasses` (DataClassesCondition, optional) - `environment` (EnvironmentCondition, optional) - `apps` (AppsCondition, optional) - `cloudProvider` (CloudProviderCondition, optional) - `accountId` (AccountIdCondition, optional) - `sourceRegion` (RegionCondition, optional) - `vpc` (VpcCondition, optional) - `subnets` (SubnetsCondition, optional) - `resourceGroupName` (ResourceGroupNameCondition, optional) - `resourceName` (ResourceNameCondition, optional) - `resourceId` (ResourceIdCondition, optional) - `tagKeys` (TagKeysCondition, optional) - `tagKeyValues` (TagKeyValuesCondition, optional) ### RoleAccessGroupCondition Group of expressions to evaluate using the logical operator specified in `operator`. Each item in the `operands` list can be either a single expression or a nested `group` expression. - `operator` (enum, required) — Logical operator to apply to the list of `operands`. `UNSPECIFIED` is supported only in responses. - Allowed values: `AND`, `OR`, `UNSPECIFIED` - `operands` (list of AccessConditionalExpression, required) — List of expressions to evaluate using the logical operator specified in `operator`. Each item in the list can be either a single expression or a nested `group` expression. Must contain at least 2 items. ### ResourceTypeCondition - `operator` (enum, required) — Evaluates whether the value is in the list. `UNSPECIFIED` is supported only in responses. - Allowed values: `IN`, `NOT_IN`, `UNSPECIFIED` - `resourceTypes` (list of enum, required) — Resource types to evaluate. `RESOURCE_TYPE_UNSPECIFIED` is supported only in responses. - Allowed values: `AWS_EC2`, `AWS_RDS`, `AWS_S3`, `AWS_EFS`, `AWS_FSX`, `AWS_EKS_NAMESPACE`, `AWS_DYNAMO_DB`, `AZURE_VIRTUAL_MACHINE`, `AZURE_FILE_SHARE`, `AZURE_STORAGE_ACCOUNT`, `AZURE_DISK`, `AZURE_SQL_DATABASE`, `AZURE_SQL_MANAGED_INSTANCE`, `AZURE_SQL_VIRTUAL_MACHINE`, `AZURE_MYSQL`, `AZURE_POSTGRESQL`, `AZURE_COSMOSDB_MONGODB`, `AZURE_COSMOSDB_NOSQL`, `ATLAS_MONGODB_CLUSTER`, `GCP_COMPUTE_ENGINE_INSTANCE`, `GCP_CLOUD_SQL_INSTANCE`, `GCP_CLOUD_STORAGE_BUCKET`, `RESOURCE_TYPE_UNSPECIFIED` ### DataClassesCondition - `operator` (enum, required) — Evaluates whether the original list constains any, all, or none of the values in this list. `UNSPECIFIED` is supported only in responses. - Allowed values: `CONTAINS_ANY_OF`, `CONTAINS_NONE_OF`, `CONTAINS_ALL_OF`, `UNSPECIFIED` - `dataClasses` (list of string, required) ### EnvironmentCondition - `operator` (enum, required) — Evaluates whether the value is in the list. `UNSPECIFIED` is supported only in responses. - Allowed values: `IN`, `NOT_IN`, `UNSPECIFIED` - `environments` (list of enum, required) - Allowed values: `PROD`, `PROD_INTERNAL`, `STAGE`, `ENVIRONMENT_UNSPECIFIED` ### AppsCondition - `operator` (enum, required) — Evaluates whether the original list constains any, all, or none of the values in this list. `UNSPECIFIED` is supported only in responses. - Allowed values: `CONTAINS_ANY_OF`, `CONTAINS_NONE_OF`, `CONTAINS_ALL_OF`, `UNSPECIFIED` - `apps` (list of string, required) ### CloudProviderCondition - `operator` (enum, required) — Evaluates whether the value is in the list. `UNSPECIFIED` is supported only in responses. - Allowed values: `IN`, `NOT_IN`, `UNSPECIFIED` - `cloudProviders` (list of enum, required) - Allowed values: `AWS`, `AZURE`, `GCP`, `MONGO_ATLAS`, `PROVIDER_UNSPECIFIED` ### AccountIdCondition - `operator` (enum, required) — Evaluates whether the value is in the list. `UNSPECIFIED` is supported only in responses. - Allowed values: `IN`, `NOT_IN`, `UNSPECIFIED` - `accountIds` (list of string, required) ### RegionCondition - `operator` (enum, required) — Evaluates whether the value is in the list. `UNSPECIFIED` is supported only in responses. - Allowed values: `IN`, `NOT_IN`, `UNSPECIFIED` - `regions` (list of string, required) ### VpcCondition - `operator` (enum, required) — Evaluates whether the value is in the list. `UNSPECIFIED` is supported only in responses. - Allowed values: `IN`, `NOT_IN`, `UNSPECIFIED` - `vpcs` (list of string, required) ### SubnetsCondition - `operator` (enum, required) — Evaluates whether the original list constains any, all, or none of the values in this list. `UNSPECIFIED` is supported only in responses. - Allowed values: `CONTAINS_ANY_OF`, `CONTAINS_NONE_OF`, `CONTAINS_ALL_OF`, `UNSPECIFIED` - `subnets` (list of string, required) ### ResourceGroupNameCondition - `operator` (enum, required) — Evaluates whether the value is in the list. `UNSPECIFIED` is supported only in responses. - Allowed values: `IN`, `NOT_IN`, `UNSPECIFIED` - `resourceGroupNames` (list of string, required) ### ResourceNameCondition - `operator` (enum, required) — Evaluates string values. `UNSPECIFIED` is supported only in responses. - Allowed values: `IN`, `NOT_IN`, `CONTAINS`, `NOT_CONTAINS`, `STARTS_WITH`, `NOT_STARTS_WITH`, `ENDS_WITH`, `NOT_ENDS_WITH`, `UNSPECIFIED` - `resourceNames` (list of string, required) ### ResourceIdCondition - `operator` (enum, required) — Evaluates whether the value is in the list. `UNSPECIFIED` is supported only in responses. - Allowed values: `IN`, `NOT_IN`, `UNSPECIFIED` - `resourceIds` (list of string, required) ### TagKeysCondition - `operator` (enum, required) — Evaluates whether the original list constains any, all, or none of the values in this list. `UNSPECIFIED` is supported only in responses. - Allowed values: `CONTAINS_ANY_OF`, `CONTAINS_NONE_OF`, `CONTAINS_ALL_OF`, `UNSPECIFIED` - `tagKeys` (list of string, required) ### TagKeyValuesCondition - `operator` (enum, required) — Evaluates whether the original list constains any, all, or none of the values in this list. `UNSPECIFIED` is supported only in responses. - Allowed values: `CONTAINS_ANY_OF`, `CONTAINS_NONE_OF`, `CONTAINS_ALL_OF`, `UNSPECIFIED` - `tagKeyValues` (list of TagKeyValue, required) ### TagKeyValue - `key` (string, required) - `value` (string, optional) ## Examples **Response** ```json { "roles": [ { "id": "daa42222-6ad2-5d37-bb26-4f2a9cba73da", "name": "My custom role", "isBuiltInRole": false, "permissionGrants": [ { "permission": "inventory.view", "accessConditionId": "Non-PII only." } ], "accessConditions": [ { "id": "Non-PII only", "effect": "INCLUSIVE", "expression": { "group": { "operator": "AND", "operands": [ { "resourceType": { "operator": "IN", "resourceTypes": [ "AWS_EC2", "AWS_RDS" ] } }, { "environment": { "operator": "IN", "environments": [ "PROD", "PROD_INTERNAL" ] } } ] }, "resourceType": { "operator": "IN", "resourceTypes": [ "AWS_EC2" ] }, "dataClasses": { "operator": "CONTAINS_ANY_OF", "dataClasses": [ "PII" ] }, "environment": { "operator": "IN", "environments": [ "PROD" ] }, "apps": { "operator": "CONTAINS_ANY_OF", "apps": [ "string" ] }, "cloudProvider": { "operator": "IN", "cloudProviders": [ "AWS" ] }, "accountId": { "operator": "IN", "accountIds": [ "string" ] }, "sourceRegion": { "operator": "IN", "regions": [ "string" ] }, "vpc": { "operator": "IN", "vpcs": [ "string" ] }, "subnets": { "operator": "CONTAINS_ANY_OF", "subnets": [ "string" ] }, "resourceGroupName": { "operator": "IN", "resourceGroupNames": [ "string" ] }, "resourceName": { "operator": "CONTAINS", "resourceNames": [ "string" ] }, "resourceId": { "operator": "IN", "resourceIds": [ "string" ] }, "tagKeys": { "operator": "CONTAINS_ANY_OF", "tagKeys": [ "string" ] }, "tagKeyValues": { "operator": "CONTAINS_ANY_OF", "tagKeyValues": [ { "key": "string", "value": "string" } ] } } } ], "restoreDestinationLimits": { "effect": "INCLUSIVE", "restoreAccountProviderIds": [ "123456789012", "987654321098" ] } } ], "totalCount": 1, "nextToken": "Y2NiMGYyZmMtYjYyZi00OTc5LTgzNjQtYmQ2YjEyYzdjZTNifDE=" } ``` **SDK Code** ```python import requests url = "https://{account-domain}.console.eon.io/api/v1/roles/list" querystring = {"pageSize":"10","pageToken":"Yjk3ODZjNjktZTIwZC00NjAxLWE1MzktZjg2NGExM2IxYTZlfDE="} headers = {"Authorization": "Bearer "} response = requests.post(url, headers=headers, params=querystring) print(response.json()) ``` ```javascript const url = 'https://{account-domain}.console.eon.io/api/v1/roles/list?pageSize=10&pageToken=Yjk3ODZjNjktZTIwZC00NjAxLWE1MzktZjg2NGExM2IxYTZlfDE%3D'; const options = {method: 'POST', headers: {Authorization: 'Bearer '}}; try { const response = await fetch(url, options); const data = await response.json(); console.log(data); } catch (error) { console.error(error); } ``` ```java import com.mashape.unirest.http.HttpResponse; import com.mashape.unirest.http.Unirest; HttpResponse response = Unirest.post("https://{account-domain}.console.eon.io/api/v1/roles/list?pageSize=10&pageToken=Yjk3ODZjNjktZTIwZC00NjAxLWE1MzktZjg2NGExM2IxYTZlfDE%3D") .header("Authorization", "Bearer ") .asString(); ```