---
title: "RoleDetails"
url: "https://dev.developer-internal.sanofi.com/apis/plta-permissions-api-cbz/versions/88cdfef8-3b56-44ca-883d-5b15378e5a3a/schemas/RoleDetails"
---

> Full API specification: https://dev.developer-internal.sanofi.com/apis/plta-permissions-api-cbz/versions/88cdfef8-3b56-44ca-883d-5b15378e5a3a.md

# RoleDetails

A role, along with its access grants, admin grants, and members.

## OpenAPI definition

```yaml
openapi: 3.1.0
info:
  title: Permission Administration API
  version: 1.5.0
servers:
  - url: https://dev.api.sanofi.com/permissions
components:
  schemas:
    Role:
      description: A named bundle of access and admin grants, scoped to an action and
        a resource. All of a role's grants are always contained within this
        scope.
      properties:
        description:
          description: A human-readable description of the role's purpose.
          type: string
        roleName:
          description: The business identifier of the role.
          examples:
            - clintrials:study-reader
          type: string
        scopeAction:
          description: The action (with its hierarchy) that bounds this role's access and
            admin grants. Immutable once the role is created.
          examples:
            - read
          type: string
        scopeResource:
          description: The resource (with its hierarchy) that bounds this role's access
            and admin grants. Immutable once the role is created.
          examples:
            - clintrials
          type: string
      required:
        - roleName
        - scopeAction
        - scopeResource
      type: object
    AccessGrant:
      description: An access right (an action/resource pair) attached to a role. Every
        member of the role inherits it. The action and resource must be within
        the role's declared scope.
      properties:
        accessGrantId:
          description: The unique identifier of the access grant, mostly for deletion
            purpose.
          format: uuid
          readOnly: true
          type: string
        actionName:
          description: Name of the action.
          examples:
            - read_narrative
          type: string
        resourceName:
          description: Name of the resource.
          examples:
            - compound_1245
          type: string
        roleName:
          description: The name of the role this grant is attached to, as given in the path.
          readOnly: true
          type: string
      required:
        - actionName
        - resourceName
      type: object
    AdminGrant:
      description: An admin right (an operation, with optional action/resource
        restrictions) attached to a role. Every member of the role inherits it.
        The restrictions must be within the role's declared scope. The caller
        must already hold an admin right covering the exact operation and
        restrictions being granted.
      properties:
        actionRestriction:
          description: Name of the action that will restrict the action usable in this
            operation to a specific hierarchy, within the role's scope.
          examples:
            - write_narrative
            - read_compound
          type: string
        adminGrantId:
          description: The unique identifier of the admin grant, mostly for deletion
            purpose.
          format: uuid
          readOnly: true
          type: string
        operationName:
          description: Name of the operation.
          examples:
            - manageActions
            - manageResources
            - manageAccessRights
          type: string
        resourceRestriction:
          description: Name of the resource that will restrict the resource usable in this
            operation to a specific hierarchy, within the role's scope.
          examples:
            - compound_1245
            - study_1245
          type: string
        roleName:
          description: The name of the role this grant is attached to, as given in the path.
          readOnly: true
          type: string
      required:
        - operationName
      type: object
    RoleMember:
      description: A user attached to a role, inheriting all of its access and admin grants.
      properties:
        attachedAt:
          description: When the user was attached to the role.
          format: date-time
          readOnly: true
          type: string
        attachedBy:
          description: The id of the user (oid or username) who performed the attach, for
            audit purposes.
          readOnly: true
          type: string
        roleName:
          description: The name of the role, as given in the path.
          readOnly: true
          type: string
        userId:
          description: The id of the user, as stored in IDP. For Sanofi internal user, it
            would be the oid (Unique identifier of the user in Azure AD)
          readOnly: true
          type: string
      readOnly: true
      required:
        - roleName
        - userId
        - attachedAt
        - attachedBy
      type: object
    RoleDetails:
      allOf:
        - $ref: "#/components/schemas/Role"
        - properties:
            accessGrants:
              description: The access grants attached to this role.
              items:
                $ref: "#/components/schemas/AccessGrant"
              readOnly: true
              type: array
            adminGrants:
              description: The admin grants attached to this role.
              items:
                $ref: "#/components/schemas/AdminGrant"
              readOnly: true
              type: array
            members:
              description: The users attached to this role.
              items:
                $ref: "#/components/schemas/RoleMember"
              readOnly: true
              type: array
          type: object
      description: A role, along with its access grants, admin grants, and members.
```