Roles

List the organization's roles and the permission catalog

Credencial

API key

Permiso

Cualquiera deroles.readsupport-access.read

curl "https://console.latam.ccsio.ai/identity/v1/organizations/{org}/roles" \
  -H "Authorization: Bearer $CCSIO_API_KEY"

Parámetros

Respuestas

• 200

  The roles and the permission catalog.

  Esquema

  ListRolesResponse

  • rolesarray of Roleobligatorio

    The four built-in roles in rank order (root, organization_admin, team_admin, user; ccsio_admin is platform-only and never listed), then the organization's custom roles by name.

    • idstringobligatorio

      pattern ^(ccsio_admin|ccsio_model_registrar|root|organization_admin|team_admin|user|role_[a-z0-9_]{1,59})$

    • kindstringobligatorio

      Valores permitidos: "builtin""custom"

    • namestringobligatorio

      1 to 64 characters

    • descriptionstringobligatorio

      at most 512 characters

    • levelsarray of stringobligatorio

      Where the role may be assigned: root and organization_admin at organization level, team_admin at team level, user and every custom role at both.

      Valores permitidos: "organization""team"

      at least 1 items

    • permissionsarray of Permissionobligatorio

      In the closed vocabulary's canonical order.

    • member_countintegeropcional

      Custom roles only.

      at least 0

    • created_atstring (date-time)opcional

      Custom roles only. RFC 3339, second precision, UTC.

    • updated_atstring (date-time)opcional

      Custom roles only. RFC 3339, second precision, UTC.

  • permission_catalogarray of PermissionCatalogEntryobligatorio

    The permissions a custom role may carry, in the closed vocabulary's canonical order.

    • idstringobligatorio

      A permission a custom role may carry: every permission except organization.delete and members.transfer (root alone), users.manage (held by ccsio_admin alone) and the platform-scoped ones (34 strings, teams.read_own among them; the two AI-199 platform-scoped permissions, the two platform-operators permissions, registry.manage, platform-usage.read, the three that write the model catalog and manage deployments, models.manage, deployments.read and deployments.manage, and the two of the model groups, model-groups.read and model-groups.manage, are not among them; mcp.invoke, mcp.read, mcp.manage and model-providers.manage are). The acting principal must effectively hold every permission it puts into a role.

      Valores permitidos: "organization.read""organization.update""teams.read""teams.read_own""teams.create""teams.update""teams.archive""team-members.read""team-members.manage""members.read""members.manage""users.read""roles.read""roles.manage""sso.manage""api-keys.read""api-keys.manage""entitlements.read""team-entitlements.manage""models.read""memory.read""memory.manage""audit.read""audit.read_own""audit.sensitive.read""usage.read""usage.read_own""usage.manage""inference.invoke""inference.read""mcp.invoke""mcp.read""mcp.manage""model-providers.manage"

    • levelsarray of stringobligatorio

      The levels a role carrying this permission may be assigned at.

      Valores permitidos: "organization""team"

      at least 1 items

• 400

  Client refusal unrelated to authentication, including malformed input, a denied or failed request.

• 401

  The request carries no credential, more than one, or one the platform does not accept, and is refused before the operation runs; `error.code` says why. Supply exactly one credential. Codes: invalid-request (no credential, or both Authorization:

  Leer más

  Bearer and x-api-key), api-key-invalid (a value that is not a platform API key, or a key of a kind the platform does not accept), api-key-unknown, api-key-revoked, api-key-expired, bootstrap-disabled (the one-shot installation credential, once a key exists), token-malformed (a bearer token that is not a JWT), token-algorithm-unsupported, token-signature-invalid, token-claim-invalid, token-issuer-mismatch, token-audience-mismatch, token-expired, token-not-yet-valid, issuer-untrusted, issuer-residency-mismatch (the issuer belongs to another plane), issuer-resolution-unknown, jwks-unavailable, jwks-key-not-found, staff-token-inactive (a platform operator's token), staff-not-operator, staff-directory-unavailable, identity-not-provisioned (a verified identity with no account on this plane), organization-not-found (a verified identity or key whose organization this plane does not know), internal-error (a fault while the credential is checked is refused too, fail closed), context-cancelled

• 402

  The organization has to pay first: its standing is payment_required.

  Leer más

  The request boundary applies this payment gate to every route except an organization's billing routes, the caller's own context, organization list, onboarding, session report and personal keys, the public routes, and the routes of platform operators, who administer an organization that has to pay. The operations the gate covers declare this response. On /v1 the refusal is rendered in the OpenAI error format. Code: payment-required

• 403

  The credential is valid but may not do this here; the request is refused by the request boundary before the handler runs, and `error.code` says which refusal. An operation may add codes of its own.

  Leer más

  Codes: policy-denied (no role of the caller holds the permission the operation needs, or the credential class may not call it: a personal API key outside inference and MCP, a route that needs a signed-in person, the one-shot installation credential outside its three steps), tenant-mismatch (the organization a path, query, body or X-Tenant header names is not the caller's own), organization-provisioning, organization-suspended, organization-disabled, organization-deleted (the state of the caller's organization), user-disabled, residency-mismatch (the organization lives on another plane), organization-selection-required (a caller with more than one organization, or a platform operator, must name one in X-Organization-Id), organization-not-selectable, no-active-organization-membership, team-not-selectable (the X-Organization-Id or X-Team-Id the caller sent does not name an organization or team it may act in), identity-managed-by-provider (a person who is not a platform operator changes an organization's status, which belongs to the identity provider), support-session-required (a platform operator reads an organization's data without an open support session)

• 404

  The requested resource or path was not found.

• 405

  The path is claimed but the request method is not allowed. Go ServeMux returns its standard plain-text response and lists permitted methods in Allow.

• 500

  Platform failure, rendered without internal cause details.

• 503

  A dependency the operation needs is not configured on this plane or could not be reached, and nothing was changed. `error.code` names it; an operation lists the ones it can answer besides the boundary's. Retry later. Codes: support-audit-unavailable (the request boundary: an operator's read under an open support session could not be recorded, so nothing was served)

Create a custom role

Credencial

API key

Permiso

roles.manage

Cuerpo de la solicitud

Cuerpo de hasta 1 MiB

curl -X POST "https://console.latam.ccsio.ai/identity/v1/organizations/{org}/roles" \
  -H "Authorization: Bearer $CCSIO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "name": "Usage analyst",
  "description": "Reads usage and the member list of the whole organization.",
  "permissions": [
    "members.read",
    "usage.read"
  ]
}'

Parámetros

Cuerpo de la solicitud application/json

Respuestas

• 201

  The created custom role (member_count 0).

  Esquema

  Role

  • idstringobligatorio

    pattern ^(ccsio_admin|ccsio_model_registrar|root|organization_admin|team_admin|user|role_[a-z0-9_]{1,59})$

  • kindstringobligatorio

    Valores permitidos: "builtin""custom"

  • namestringobligatorio

    1 to 64 characters

  • descriptionstringobligatorio

    at most 512 characters

  • levelsarray of stringobligatorio

    Where the role may be assigned: root and organization_admin at organization level, team_admin at team level, user and every custom role at both.

    Valores permitidos: "organization""team"

    at least 1 items

  • permissionsarray of Permissionobligatorio

    In the closed vocabulary's canonical order.

    Valores permitidos: "organization.create""organization.read""organization.update""organization.delete""organization.status""teams.read""teams.read_own""teams.create""teams.update""teams.archive""team-members.read""team-members.manage""members.read""members.manage""members.transfer""users.read""users.manage""roles.read""roles.manage""sso.manage""api-keys.read""api-keys.manage""entitlements.read""entitlements.manage""team-entitlements.manage""issuers.read""issuers.manage""models.read""models.manage""models.register""model-registrars.manage""platform-operators.read""platform-operators.manage""registry.manage""platform-usage.read""support-sessions.start""support-sessions.manage""support-access.read""deployments.read""deployments.manage""model-groups.read""model-groups.manage""memory.read""memory.manage""audit.read""audit.read_own""audit.sensitive.read""usage.read""usage.read_own""usage.manage""inference.invoke""inference.read""mcp.invoke""mcp.read""mcp.manage""model-providers.manage"

  • member_countintegeropcional

    Custom roles only.

    at least 0

  • created_atstring (date-time)opcional

    Custom roles only. RFC 3339, second precision, UTC.

  • updated_atstring (date-time)opcional

    Custom roles only. RFC 3339, second precision, UTC.

• 400

  Client refusal unrelated to authentication, including malformed input, a denied or failed request.

• 401

  The request carries no credential, more than one, or one the platform does not accept, and is refused before the operation runs; `error.code` says why. Supply exactly one credential. Codes: invalid-request (no credential, or both Authorization:

  Leer más

  Bearer and x-api-key), api-key-invalid (a value that is not a platform API key, or a key of a kind the platform does not accept), api-key-unknown, api-key-revoked, api-key-expired, bootstrap-disabled (the one-shot installation credential, once a key exists), token-malformed (a bearer token that is not a JWT), token-algorithm-unsupported, token-signature-invalid, token-claim-invalid, token-issuer-mismatch, token-audience-mismatch, token-expired, token-not-yet-valid, issuer-untrusted, issuer-residency-mismatch (the issuer belongs to another plane), issuer-resolution-unknown, jwks-unavailable, jwks-key-not-found, staff-token-inactive (a platform operator's token), staff-not-operator, staff-directory-unavailable, identity-not-provisioned (a verified identity with no account on this plane), organization-not-found (a verified identity or key whose organization this plane does not know), internal-error (a fault while the credential is checked is refused too, fail closed), context-cancelled

• 402

  The organization has to pay first: its standing is payment_required.

  Leer más

  The request boundary applies this payment gate to every route except an organization's billing routes, the caller's own context, organization list, onboarding, session report and personal keys, the public routes, and the routes of platform operators, who administer an organization that has to pay. The operations the gate covers declare this response. On /v1 the refusal is rendered in the OpenAI error format. Code: payment-required

• 403

  The credential is valid but may not do this here; the request is refused by the request boundary before the handler runs, and `error.code` says which refusal. An operation may add codes of its own.

  Leer más

  Codes: policy-denied (no role of the caller holds the permission the operation needs, or the credential class may not call it: a personal API key outside inference and MCP, a route that needs a signed-in person, the one-shot installation credential outside its three steps), tenant-mismatch (the organization a path, query, body or X-Tenant header names is not the caller's own), organization-provisioning, organization-suspended, organization-disabled, organization-deleted (the state of the caller's organization), user-disabled, residency-mismatch (the organization lives on another plane), organization-selection-required (a caller with more than one organization, or a platform operator, must name one in X-Organization-Id), organization-not-selectable, no-active-organization-membership, team-not-selectable (the X-Organization-Id or X-Team-Id the caller sent does not name an organization or team it may act in), identity-managed-by-provider (a person who is not a platform operator changes an organization's status, which belongs to the identity provider), support-session-required (a platform operator reads an organization's data without an open support session)

• 404

  The requested resource or path was not found.

• 405

  The path is claimed but the request method is not allowed. Go ServeMux returns its standard plain-text response and lists permitted methods in Allow.

• 409

  The request conflicts with the current state of the resource or with an invariant it protects (a taken name, a role still in use, an organization that must not be deleted, an archived team, the last active root, a seat or service account limit).

• 500

  Platform failure, rendered without internal cause details.

• 503

  A dependency the operation needs is not configured on this plane or could not be reached, and nothing was changed. `error.code` names it; an operation lists the ones it can answer besides the boundary's. Retry later. Codes: support-audit-unavailable (the request boundary: an operator's read under an open support session could not be recorded, so nothing was served)

{
  "id": "role_01k7yq4d8m2p6s9v3x5z7b1c4f",
  "kind": "custom",
  "name": "Usage analyst",
  "description": "Reads usage and the member list of the whole organization.",
  "levels": [
    "organization",
    "team"
  ],
  "permissions": [
    "members.read",
    "usage.read"
  ],
  "member_count": 0,
  "created_at": "2026-10-14T09:45:00Z",
  "updated_at": "2026-10-14T09:45:00Z"
}

Update a custom role

Credencial

API key

Permiso

roles.manage

Cuerpo de la solicitud

Cuerpo de hasta 1 MiB

curl -X PATCH "https://console.latam.ccsio.ai/identity/v1/organizations/{org}/roles/{role}" \
  -H "Authorization: Bearer $CCSIO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{}'

Parámetros

Cuerpo de la solicitud application/json

Respuestas

• 200

  The updated custom role.

  Esquema

  Role

  • idstringobligatorio

    pattern ^(ccsio_admin|ccsio_model_registrar|root|organization_admin|team_admin|user|role_[a-z0-9_]{1,59})$

  • kindstringobligatorio

    Valores permitidos: "builtin""custom"

  • namestringobligatorio

    1 to 64 characters

  • descriptionstringobligatorio

    at most 512 characters

  • levelsarray of stringobligatorio

    Where the role may be assigned: root and organization_admin at organization level, team_admin at team level, user and every custom role at both.

    Valores permitidos: "organization""team"

    at least 1 items

  • permissionsarray of Permissionobligatorio

    In the closed vocabulary's canonical order.

    Valores permitidos: "organization.create""organization.read""organization.update""organization.delete""organization.status""teams.read""teams.read_own""teams.create""teams.update""teams.archive""team-members.read""team-members.manage""members.read""members.manage""members.transfer""users.read""users.manage""roles.read""roles.manage""sso.manage""api-keys.read""api-keys.manage""entitlements.read""entitlements.manage""team-entitlements.manage""issuers.read""issuers.manage""models.read""models.manage""models.register""model-registrars.manage""platform-operators.read""platform-operators.manage""registry.manage""platform-usage.read""support-sessions.start""support-sessions.manage""support-access.read""deployments.read""deployments.manage""model-groups.read""model-groups.manage""memory.read""memory.manage""audit.read""audit.read_own""audit.sensitive.read""usage.read""usage.read_own""usage.manage""inference.invoke""inference.read""mcp.invoke""mcp.read""mcp.manage""model-providers.manage"

  • member_countintegeropcional

    Custom roles only.

    at least 0

  • created_atstring (date-time)opcional

    Custom roles only. RFC 3339, second precision, UTC.

  • updated_atstring (date-time)opcional

    Custom roles only. RFC 3339, second precision, UTC.

• 400

  Client refusal unrelated to authentication, including malformed input, a denied or failed request.

• 401

  The request carries no credential, more than one, or one the platform does not accept, and is refused before the operation runs; `error.code` says why. Supply exactly one credential. Codes: invalid-request (no credential, or both Authorization:

  Leer más

  Bearer and x-api-key), api-key-invalid (a value that is not a platform API key, or a key of a kind the platform does not accept), api-key-unknown, api-key-revoked, api-key-expired, bootstrap-disabled (the one-shot installation credential, once a key exists), token-malformed (a bearer token that is not a JWT), token-algorithm-unsupported, token-signature-invalid, token-claim-invalid, token-issuer-mismatch, token-audience-mismatch, token-expired, token-not-yet-valid, issuer-untrusted, issuer-residency-mismatch (the issuer belongs to another plane), issuer-resolution-unknown, jwks-unavailable, jwks-key-not-found, staff-token-inactive (a platform operator's token), staff-not-operator, staff-directory-unavailable, identity-not-provisioned (a verified identity with no account on this plane), organization-not-found (a verified identity or key whose organization this plane does not know), internal-error (a fault while the credential is checked is refused too, fail closed), context-cancelled

• 402

  The organization has to pay first: its standing is payment_required.

  Leer más

  The request boundary applies this payment gate to every route except an organization's billing routes, the caller's own context, organization list, onboarding, session report and personal keys, the public routes, and the routes of platform operators, who administer an organization that has to pay. The operations the gate covers declare this response. On /v1 the refusal is rendered in the OpenAI error format. Code: payment-required

• 403

  The credential is valid but may not do this here; the request is refused by the request boundary before the handler runs, and `error.code` says which refusal. An operation may add codes of its own.

  Leer más

  Codes: policy-denied (no role of the caller holds the permission the operation needs, or the credential class may not call it: a personal API key outside inference and MCP, a route that needs a signed-in person, the one-shot installation credential outside its three steps), tenant-mismatch (the organization a path, query, body or X-Tenant header names is not the caller's own), organization-provisioning, organization-suspended, organization-disabled, organization-deleted (the state of the caller's organization), user-disabled, residency-mismatch (the organization lives on another plane), organization-selection-required (a caller with more than one organization, or a platform operator, must name one in X-Organization-Id), organization-not-selectable, no-active-organization-membership, team-not-selectable (the X-Organization-Id or X-Team-Id the caller sent does not name an organization or team it may act in), identity-managed-by-provider (a person who is not a platform operator changes an organization's status, which belongs to the identity provider), support-session-required (a platform operator reads an organization's data without an open support session)

• 404

  The requested resource or path was not found.

• 405

  The path is claimed but the request method is not allowed. Go ServeMux returns its standard plain-text response and lists permitted methods in Allow.

• 409

  The request conflicts with the current state of the resource or with an invariant it protects (a taken name, a role still in use, an organization that must not be deleted, an archived team, the last active root, a seat or service account limit).

• 500

  Platform failure, rendered without internal cause details.

• 503

  A dependency the operation needs is not configured on this plane or could not be reached, and nothing was changed. `error.code` names it; an operation lists the ones it can answer besides the boundary's. Retry later. Codes: support-audit-unavailable (the request boundary: an operator's read under an open support session could not be recorded, so nothing was served)

Delete a custom role

Credencial

API key

Permiso

roles.manage

curl -X DELETE "https://console.latam.ccsio.ai/identity/v1/organizations/{org}/roles/{role}" \
  -H "Authorization: Bearer $CCSIO_API_KEY"

Parámetros

Respuestas

• 204

  The role was deleted.

• 400

  Client refusal unrelated to authentication, including malformed input, a denied or failed request.

• 401

  The request carries no credential, more than one, or one the platform does not accept, and is refused before the operation runs; `error.code` says why. Supply exactly one credential. Codes: invalid-request (no credential, or both Authorization:

  Leer más

  Bearer and x-api-key), api-key-invalid (a value that is not a platform API key, or a key of a kind the platform does not accept), api-key-unknown, api-key-revoked, api-key-expired, bootstrap-disabled (the one-shot installation credential, once a key exists), token-malformed (a bearer token that is not a JWT), token-algorithm-unsupported, token-signature-invalid, token-claim-invalid, token-issuer-mismatch, token-audience-mismatch, token-expired, token-not-yet-valid, issuer-untrusted, issuer-residency-mismatch (the issuer belongs to another plane), issuer-resolution-unknown, jwks-unavailable, jwks-key-not-found, staff-token-inactive (a platform operator's token), staff-not-operator, staff-directory-unavailable, identity-not-provisioned (a verified identity with no account on this plane), organization-not-found (a verified identity or key whose organization this plane does not know), internal-error (a fault while the credential is checked is refused too, fail closed), context-cancelled

• 402

  The organization has to pay first: its standing is payment_required.

  Leer más

  The request boundary applies this payment gate to every route except an organization's billing routes, the caller's own context, organization list, onboarding, session report and personal keys, the public routes, and the routes of platform operators, who administer an organization that has to pay. The operations the gate covers declare this response. On /v1 the refusal is rendered in the OpenAI error format. Code: payment-required

• 403

  The credential is valid but may not do this here; the request is refused by the request boundary before the handler runs, and `error.code` says which refusal. An operation may add codes of its own.

  Leer más

  Codes: policy-denied (no role of the caller holds the permission the operation needs, or the credential class may not call it: a personal API key outside inference and MCP, a route that needs a signed-in person, the one-shot installation credential outside its three steps), tenant-mismatch (the organization a path, query, body or X-Tenant header names is not the caller's own), organization-provisioning, organization-suspended, organization-disabled, organization-deleted (the state of the caller's organization), user-disabled, residency-mismatch (the organization lives on another plane), organization-selection-required (a caller with more than one organization, or a platform operator, must name one in X-Organization-Id), organization-not-selectable, no-active-organization-membership, team-not-selectable (the X-Organization-Id or X-Team-Id the caller sent does not name an organization or team it may act in), identity-managed-by-provider (a person who is not a platform operator changes an organization's status, which belongs to the identity provider), support-session-required (a platform operator reads an organization's data without an open support session)

• 404

  The requested resource or path was not found.

• 405

  The path is claimed but the request method is not allowed. Go ServeMux returns its standard plain-text response and lists permitted methods in Allow.

• 409

  The request conflicts with the current state of the resource or with an invariant it protects (a taken name, a role still in use, an organization that must not be deleted, an archived team, the last active root, a seat or service account limit).

• 500

  Platform failure, rendered without internal cause details.

• 503

  A dependency the operation needs is not configured on this plane or could not be reached, and nothing was changed. `error.code` names it; an operation lists the ones it can answer besides the boundary's. Retry later. Codes: support-audit-unavailable (the request boundary: an operator's read under an open support session could not be recorded, so nothing was served)