# List roles

`GET https://api.mailmasker.org/api/v1/admin/roles`

Every role, whether it can be deleted, and the permissions it carries.

- Who can use it: Site admins
- Area: Users and roles
- Answers 200 OK when it works
- Page: https://developer.mailmasker.org/admin-list-roles

In the order they were made. `protected` is 1 for the three built-in roles that can't be deleted, and 0 for the rest: `user`, `site_admin`, and `system_agent`, the role the fleet's own services sign in with. `site_admin` carries no permissions because it needs none: a site admin may always do everything.

## Examples

cURL:

```bash
curl -s 'https://api.mailmasker.org/api/v1/admin/roles' \
  -H "Authorization: Bearer $TOKEN"
```

Perl:

```perl
use Mojo::Base -strict;
use Mojo::UserAgent;

my $ua  = Mojo::UserAgent->new;
my $res = $ua->get('https://api.mailmasker.org/api/v1/admin/roles',
    { Authorization => "Bearer $ENV{TOKEN}" })->result;
die $res->code, ' ', ($res->json('/error') // $res->message), "\n" unless $res->is_success;
print $res->body, "\n";
```

homelab-cli:

```bash
homelab-cli admin roles list
```

## Response

200 OK:

```json
[
  {
    "id": 1,
    "name": "user",
    "description": "Default role -- standard API access",
    "protected": 1,
    "created_at": "2026-10-12 13:58:20.118347-05",
    "permissions": []
  },
  {
    "id": 2,
    "name": "site_admin",
    "description": "Administrative capabilities (informational only; admin routes are hardcoded, not gated by a table, so a bad edit can't lock every admin out)",
    "protected": 1,
    "created_at": "2026-10-12 13:58:20.118347-05",
    "permissions": []
  },
  {
    "id": 4,
    "name": "auditor",
    "description": "Reads the audit log",
    "protected": 0,
    "created_at": "2026-11-03 21:42:10.123456-06",
    "permissions": ["audit.view"]
  }
]
```