> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cube.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# List a user's roles

**🔒 Admin only.** Requires administrator privileges — the authenticated principal (API key, embed JWT, or any bearer token) must belong to a user with the admin role.

Every role the user holds, built-in and custom, whether assigned directly or through a group. Only a direct assignment can be removed with `DELETE /api/v1/roles/{roleId}/users/{userId}`.

An API key scoped to specific deployments answers `403` here.


## OpenAPI

````yaml /api-reference/api.yaml get /api/v1/users/{id}/roles
openapi: 3.1.0
info:
  title: Cube Platform API
  version: 1.0.0
  description: >-
    Programmatically manage Cube: deployments and everything scoped to them

    (environments, folders, reports, workbooks, notifications, workspace, and
    agents),

    plus account-level users, groups, policies, embedding, and AI settings.
    Data-model

    authoring, dev mode, branches, and uploads live under /build/api/v1 — same
    host and

    token, routed to the build pods.
servers:
  - url: https://{tenant}.cubecloud.dev
    description: Your tenant host. Replace the whole host if you use a custom domain.
    variables:
      tenant:
        default: your-tenant
        description: Your Cube tenant subdomain
security:
  - bearerAuth: []
tags:
  - name: Deployments
  - name: Deployment Creation
  - name: Environments
  - name: Env Variables
  - name: Regions
  - name: Data Model
  - name: Data Model Uploads
  - name: GitHub
  - name: GitHub Connection
  - name: dbt Sync
  - name: Databricks Metric View Publication
  - name: Databricks Metric View Integration
  - name: Snowflake Semantic View Sync
  - name: Folders
  - name: Reports
  - name: External Documents
  - name: Workbooks
  - name: Workbook Promotions
  - name: Dashboard Exports
  - name: Notifications
  - name: Scheduled Tasks
  - name: Workspace
  - name: Agents
  - name: Users
  - name: Users Admin
  - name: API Keys
  - name: Roles
  - name: User Attributes
  - name: User Attribute Values
  - name: Tenant Settings
  - name: OAuth Integrations
  - name: User OAuth Tokens
  - name: OIDC Token Configs
  - name: App Theme
  - name: Embed
  - name: Embed Tenants
  - name: Dashboard Embed Access
  - name: Usage Analytics
  - name: OpenAPI Spec
  - name: Chat History
  - name: Ossie Conversion
  - name: Report Deliveries
paths:
  /api/v1/users/{id}/roles:
    get:
      tags:
        - Users Admin
      summary: List a user's roles
      operationId: getUserRoles
      parameters:
        - in: path
          name: id
          required: true
          schema:
            type: number
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UserRolesResponse'
          description: ''
        '404':
          description: The user is unknown.
components:
  schemas:
    UserRolesResponse:
      properties:
        isAdmin:
          description: Set by the user's own Admin flag or by a group granting Admin.
          type: boolean
        roles:
          items:
            $ref: '#/components/schemas/UserRoleAssignmentResponse'
          type: array
      required:
        - isAdmin
        - roles
      type: object
    UserRoleAssignmentResponse:
      properties:
        builtIn:
          type: boolean
        description:
          oneOf:
            - type: string
            - type: 'null'
        direct:
          description: >-
            Assigned to the user directly — the assignment `DELETE
            /api/v1/roles/{roleId}/users/{userId}` removes.
          type: boolean
        groupIds:
          description: >-
            Groups that grant the role. Removing it from the user does not touch
            these; change the group instead.
          items:
            type: integer
          type: array
        id:
          description: Role id. Built-in roles have fixed negative ids.
          type: integer
        name:
          type: string
      required:
        - id
        - name
        - builtIn
        - direct
        - groupIds
      type: object
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      description: 'Token authentication. Send `Authorization: Bearer <YOUR_TOKEN>`.'

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.