`get_roles_by_id_permissions`

Read-only

Calls GET /api/roles/{id}/permissions as the signed-in person · REST reference

Get a role's permissions, grouped by category

Same read scope as GET /api/roles/{id} — a role outside it is a 404. permissions is the flat list; categorized is the SAME strings bucketed for display, so every permission appears twice in the response. The bucket key is derived from the substring BEFORE the first . and mapped through a fixed display-name table (admin → "Admin Core", org → "Organization Management", distributor → "Distribution", donor → "Donor Management", support → "Support Operations", exports → "Data Exports"); anything else is capitalised as-is. A CQRS-style permission such as execute:CreateRoleCommand has no ., so its bucket key is the whole string capitalised: one bucket per permission.

Arguments

Argument	Type		Description
`id`path	string (uuid)	required

Example call

A client sends this over the MCP session; Claude and other agents build it for you. The values are placeholders — the shape is real.

json

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "get_roles_by_id_permissions",
    "arguments": {
      "id": "11111111-1111-4111-8111-111111111111"
    }
  }
}

Result

On success (HTTP 200) the tool returns one text item holding the API's JSON, pretty-printed.

The role's permissions, flat and bucketed, in the success envelope.

json

{
  "data": {
    "categorized": {
      "key": []
    },
    "permissions": [
      "string"
    ],
    "roleId": "11111111-1111-4111-8111-111111111111",
    "roleName": "string"
  },
  "success": true
}

Fields

Field	Type	Description
`data`	object
`data.categorized`	object	Display-name key to the permissions in that bucket. Same strings as `permissions`, partitioned.
`data.permissions`	array of string
`data.roleId`	string (uuid)
`data.roleName`	string
`success`	true

When it fails

A failed call returns isError: true with the API's message as text.

400: id is not a UUID. ARRAY-shaped details.
403: Authenticated, but the caller holds none of the required permissions.
404: No such role. Carries code: ROLE_NOT_FOUND.

What the model is shown

This is the tool exactly as the server lists it in tools/list. The description starts with the REST call it makes.

json

{
  "name": "get_roles_by_id_permissions",
  "description": "GET /api/roles/{id}/permissions — Same read scope as `GET /api/roles/{id}` — a role outside it is a 404. `permissions` is the flat list; `categorized` is the SAME strings bucketed for display, so every permission appears twice in the response. The bucket key is derived from the substring BEFORE the first `.` and mapped through a fixed display-name table (admin → \"Admin Core\", org → \"Organization Management\", distributor → \"Distribution\", donor → \"Donor Management\", support → \"Support Operations\", exports → \"Data Exports\"); anything else is capitalised as-is. A CQRS-style permission such as `execute:CreateRoleCommand` has no `.`, so its bucket key is the whole string capitalised: one bucket per permission.",
  "inputSchema": {
    "type": "object",
    "properties": {
      "id": {
        "type": "string"
      }
    },
    "required": [
      "id"
    ]
  },
  "annotations": {
    "readOnlyHint": true,
    "openWorldHint": false
  }
}