Access
Who belongs to an account and what each member may do. permissions is the tree of sections a right is granted on — READ or WRITE, and a grant covers everything under its section — roles the three every account has: administrator, editor, and one that holds only the sections its membership grants, accounts/{account}/roles the named sets of grants an account defines for itself, accounts/{account}/members the account’s members with their roles, and accounts/{account}/invitations the people asked to join by e-mail — who take the mailed link up with invitations:accept. A route a member’s role does not reach answers PERMISSION_DENIED.
List invitations
An invitation to join the account, mailed to an address with a one-time link. Whoever holds the link reads what it is for with invitations:inspect and takes it up with invitations:accept — signed in as the invited address, or as a new user choosing a password. Accepting makes a member with the invitation's role and uses the invitation up. Listing, reading, sending and withdrawing invitations take the account.access section.
path Parameters
account_idId of the parent account.
query Parameters
page_sizeRows per page. Over the maximum is clamped, not rejected.
page_tokenOpaque token from a previous next_page_token. A token minted under a different order_by/filter is rejected.
skipRows to skip before the page (AIP-158). skip + page_size is capped at 10000; beyond that is OUT_OF_RANGE.
order_byComma-separated field [asc|desc], at most 3 keys. Default: email asc. Sortable: none — this collection serves its documented order only.
filterAIP-160 subset (§8). Filterable: email, role, state. A field outside the list is INVALID_ARGUMENT.
List invitations › Responses
One page of invitations.
This page of invitations, in the requested order.
next_page_tokenOpaque. Absent or empty means this was the last page.
total_sizeRows in the whole filtered collection, not in this page.
Create invitation
Invites somebody to join the account: send email, role and — for roles/sections — the grants. A mail goes to the address with a one-time link, valid for 7 days, that opens the invitation in the admin app; the link is in the mail only and never in a response. Nobody may invite with a role or a grant wider than their own: that is PERMISSION_DENIED. An address that belongs to a member, or already has a pending invitation, is ALREADY_EXISTS on email. Send a request_id to make the call safe to repeat: a repeat returns the first invitation and mails nothing.
path Parameters
account_idId of the parent account.
Create invitation › Request Body
emailThe address the invitation is mailed to, stored lowercase. One pending invitation per address: inviting it again, or inviting a member's address, is ALREADY_EXISTS. The list is ordered by it.
roleThe role the membership will hold once the invitation is accepted: roles/admin, roles/editor or roles/sections (see roles), or one of the account's own, accounts/{account}/roles/{role}. Nobody may invite with a role wider than their own: that is PERMISSION_DENIED.
grantsThe sections a roles/sections invitation grants, as {permission, level} — a section id from permissions and READ or WRITE. Empty, and refused when sent, under any other role. Nobody may grant a section they do not hold themselves.
request_idAn idempotency key you choose, at most 64 characters. Creating with a key already used in this account returns the invitation that key created, and mails nothing.
Create invitation › Responses
The created resource.
nameThe resource name (§5) — the identity of this resource, and the path that addresses it: websites/{website}/cms_pages/{cms_page}. It is the handle to store, not a human label.
idThe last segment of name on its own, for a client that needs to build a child URL. Unique inside its parent, never across the platform.
create_timeWhen the resource was created (RFC 3339, UTC).
update_timeWhen the resource last changed (RFC 3339, UTC).
etagVersion of the persisted state. Send it back in If-Match on Update or Delete and the write is rejected with ABORTED if anyone else changed the resource meanwhile (§14).
emailThe address the invitation is mailed to, stored lowercase. One pending invitation per address: inviting it again, or inviting a member's address, is ALREADY_EXISTS. The list is ordered by it.
roleThe role the membership will hold once the invitation is accepted: roles/admin, roles/editor or roles/sections (see roles), or one of the account's own, accounts/{account}/roles/{role}. Nobody may invite with a role wider than their own: that is PERMISSION_DENIED.
grantsThe sections a roles/sections invitation grants, as {permission, level} — a section id from permissions and READ or WRITE. Empty, and refused when sent, under any other role. Nobody may grant a section they do not hold themselves.
inviterThe member who sent the invitation, as users/{user}; absent once that user no longer exists.
statePENDING until expire_time, then EXPIRED: the link no longer works, but the invitation stays listed for 30 days so it can be sent again with :resend — or withdrawn. An accepted invitation is gone.
expire_timeWhen the link stops working: 7 days after the invitation was sent, or sent again.
Get invitation
An invitation to join the account, mailed to an address with a one-time link. Whoever holds the link reads what it is for with invitations:inspect and takes it up with invitations:accept — signed in as the invited address, or as a new user choosing a password. Accepting makes a member with the invitation's role and uses the invitation up. Listing, reading, sending and withdrawing invitations take the account.access section.
path Parameters
account_idId of the parent account.
invitation_idId of the parent invitation.
Headers
If-None-MatchA matching etag answers 304 with no body (§16).
Get invitation › Responses
The resource.
nameThe resource name (§5) — the identity of this resource, and the path that addresses it: websites/{website}/cms_pages/{cms_page}. It is the handle to store, not a human label.
idThe last segment of name on its own, for a client that needs to build a child URL. Unique inside its parent, never across the platform.
create_timeWhen the resource was created (RFC 3339, UTC).
update_timeWhen the resource last changed (RFC 3339, UTC).
etagVersion of the persisted state. Send it back in If-Match on Update or Delete and the write is rejected with ABORTED if anyone else changed the resource meanwhile (§14).
emailThe address the invitation is mailed to, stored lowercase. One pending invitation per address: inviting it again, or inviting a member's address, is ALREADY_EXISTS. The list is ordered by it.
roleThe role the membership will hold once the invitation is accepted: roles/admin, roles/editor or roles/sections (see roles), or one of the account's own, accounts/{account}/roles/{role}. Nobody may invite with a role wider than their own: that is PERMISSION_DENIED.
grantsThe sections a roles/sections invitation grants, as {permission, level} — a section id from permissions and READ or WRITE. Empty, and refused when sent, under any other role. Nobody may grant a section they do not hold themselves.
inviterThe member who sent the invitation, as users/{user}; absent once that user no longer exists.
statePENDING until expire_time, then EXPIRED: the link no longer works, but the invitation stays listed for 30 days so it can be sent again with :resend — or withdrawn. An accepted invitation is gone.
expire_timeWhen the link stops working: 7 days after the invitation was sent, or sent again.
Delete invitation
Withdraws an invitation: its link stops working at once, and the address may be invited again.
path Parameters
account_idId of the parent account.
invitation_idId of the parent invitation.
Headers
If-MatchThe etag the client last read. A mismatch is ABORTED (409) with the current resource in the error details (§14).
Delete invitation › Responses
Deleted. No body (§7).
Resend (invitations)
Mails the invitation again with a new link and a new 7 days — pending or expired alike — and answers the invitation. The previous link stops working. Sending it again hands its role out again, so it takes holding that role, as sending it did.
path Parameters
account_idId of the parent account.
invitation_idId of the parent invitation.
Resend (invitations) › Request Body optional
Resend (invitations) › Responses
The affected resource, or the method’s own response object (§10).
List members
Who belongs to the account and what each of them may do. Listing the members, reading someone else's membership, changing a role and removing a member take the account.access section; every member may read their own membership, members/{their user id}, and leave the account by deleting it. The owner is a member too and cannot be removed or leave: ownership is handed over first.
path Parameters
account_idId of the parent account.
query Parameters
page_sizeRows per page. Over the maximum is clamped, not rejected.
page_tokenOpaque token from a previous next_page_token. A token minted under a different order_by/filter is rejected.
skipRows to skip before the page (AIP-158). skip + page_size is capped at 10000; beyond that is OUT_OF_RANGE.
order_byComma-separated field [asc|desc], at most 3 keys. Default: email asc. Sortable: none — this collection serves its documented order only.
filterAIP-160 subset (§8). Filterable: email, is_owner, role. A field outside the list is INVALID_ARGUMENT.
List members › Responses
One page of members.
This page of members, in the requested order.
next_page_tokenOpaque. Absent or empty means this was the last page.
total_sizeRows in the whole filtered collection, not in this page.
Get member
Reads one membership. Every member may read their own — members/{their user id}, with is_owner and the effective_grants a client builds its menus from; reading anyone else's takes account.access.
path Parameters
account_idId of the parent account.
member_idId of the parent member.
Headers
If-None-MatchA matching etag answers 304 with no body (§16).
Get member › Responses
The resource.
nameThe resource name (§5) — the identity of this resource, and the path that addresses it: websites/{website}/cms_pages/{cms_page}. It is the handle to store, not a human label.
idThe last segment of name on its own, for a client that needs to build a child URL. Unique inside its parent, never across the platform.
create_timeWhen the resource was created (RFC 3339, UTC).
update_timeWhen the resource last changed (RFC 3339, UTC).
etagVersion of the persisted state. Send it back in If-Match on Update or Delete and the write is rejected with ABORTED if anyone else changed the resource meanwhile (§14).
userThe member, as users/{user} — the same name the account's owner uses. The last segment is also this membership's id.
emailThe member's email address, from their user profile. The list is ordered by it.
firstnameThe member's first name, from their user profile; absent when they gave none.
lastnameThe member's last name, from their user profile; absent when they gave none.
roleThe membership's role: roles/admin, roles/editor or roles/sections (see roles), or one of the account's own, accounts/{account}/roles/{role} — never another account's. The owner's membership reads roles/admin — dormant while they own the account, and what they keep after handing it over — and cannot be changed. Nobody may give a role wider than their own: that is PERMISSION_DENIED.
grantsThe sections a roles/sections membership holds, as {permission, level} — a section id from permissions and READ or WRITE. Empty, and refused when sent, under any other role. Nobody may give a grant they do not hold themselves.
is_ownerTrue for the account's one owner, who holds everything whatever the role says. The owner's membership is neither removed nor changed; the account is handed over first (accounts/{account}:transfer_ownership).
effective_grantsWhat the member actually holds, computed on every read: the role's grants — or the membership's own — with implies followed, minimal and in the order of permissions. The owner's are everything. Sections every member may read are readable whatever this says.
Delete member
Ends a membership. A member may delete their own and so leave the account; removing someone else takes account.access: WRITE. The owner can be neither removed nor leave — FAILED_PRECONDITION — until they hand the account over with accounts/{account}:transfer_ownership.
path Parameters
account_idId of the parent account.
member_idId of the parent member.
Headers
If-MatchThe etag the client last read. A mismatch is ABORTED (409) with the current resource in the error details (§14).
Delete member › Responses
Deleted. No body (§7).
Update member
Changes a member's role, and the grants of a roles/sections membership. Takes account.access: WRITE, and nobody may give a role or a grant wider than their own — that is PERMISSION_DENIED; the owner and roles/admin hold everything, so they are never refused for it. The owner's own membership cannot be changed: FAILED_PRECONDITION.
path Parameters
account_idId of the parent account.
member_idId of the parent member.
query Parameters
update_maskComma-separated field paths to merge. A field named here and sent as null is cleared; without the mask a null is dropped (§7, §11).
Headers
If-MatchThe etag the client last read. A mismatch is ABORTED (409) with the current resource in the error details (§14).
Update member › Request Body
roleThe membership's role: roles/admin, roles/editor or roles/sections (see roles), or one of the account's own, accounts/{account}/roles/{role} — never another account's. The owner's membership reads roles/admin — dormant while they own the account, and what they keep after handing it over — and cannot be changed. Nobody may give a role wider than their own: that is PERMISSION_DENIED.
grantsThe sections a roles/sections membership holds, as {permission, level} — a section id from permissions and READ or WRITE. Empty, and refused when sent, under any other role. Nobody may give a grant they do not hold themselves.
Update member › Responses
The updated resource.
nameThe resource name (§5) — the identity of this resource, and the path that addresses it: websites/{website}/cms_pages/{cms_page}. It is the handle to store, not a human label.
idThe last segment of name on its own, for a client that needs to build a child URL. Unique inside its parent, never across the platform.
create_timeWhen the resource was created (RFC 3339, UTC).
update_timeWhen the resource last changed (RFC 3339, UTC).
etagVersion of the persisted state. Send it back in If-Match on Update or Delete and the write is rejected with ABORTED if anyone else changed the resource meanwhile (§14).
userThe member, as users/{user} — the same name the account's owner uses. The last segment is also this membership's id.
emailThe member's email address, from their user profile. The list is ordered by it.
firstnameThe member's first name, from their user profile; absent when they gave none.
lastnameThe member's last name, from their user profile; absent when they gave none.
roleThe membership's role: roles/admin, roles/editor or roles/sections (see roles), or one of the account's own, accounts/{account}/roles/{role} — never another account's. The owner's membership reads roles/admin — dormant while they own the account, and what they keep after handing it over — and cannot be changed. Nobody may give a role wider than their own: that is PERMISSION_DENIED.
grantsThe sections a roles/sections membership holds, as {permission, level} — a section id from permissions and READ or WRITE. Empty, and refused when sent, under any other role. Nobody may give a grant they do not hold themselves.
is_ownerTrue for the account's one owner, who holds everything whatever the role says. The owner's membership is neither removed nor changed; the account is handed over first (accounts/{account}:transfer_ownership).
effective_grantsWhat the member actually holds, computed on every read: the role's grants — or the membership's own — with implies followed, minimal and in the order of permissions. The owner's are everything. Sections every member may read are readable whatever this says.
List roles
The account's own roles: named sets of grants, defined once and given to members and invitations by name — role: accounts/{account}/roles/{role} — beside the three roles every account has (roles). A member's rights follow the role, so changing its grants changes what every holder may do. Reading the roles takes the account.access section; defining, changing and deleting them takes writing it. A role that a member holds or an invitation names is not deleted, and deleting the account deletes its roles.
path Parameters
account_idId of the parent account.
query Parameters
page_sizeRows per page. Over the maximum is clamped, not rejected.
page_tokenOpaque token from a previous next_page_token. A token minted under a different order_by/filter is rejected.
skipRows to skip before the page (AIP-158). skip + page_size is capped at 10000; beyond that is OUT_OF_RANGE.
order_byComma-separated field [asc|desc], at most 3 keys. Default: display_name asc. Sortable: none — this collection serves its documented order only.
filterAIP-160 subset (§8). Filterable: display_name. A field outside the list is INVALID_ARGUMENT.
List roles › Responses
One page of roles.
This page of roles, in the requested order.
next_page_tokenOpaque. Absent or empty means this was the last page.
total_sizeRows in the whole filtered collection, not in this page.
Create role
Defines a role of the account: send display_name, and the grants it holds — the same {permission, level} a roles/sections membership carries — with an optional description. Give it to a member or an invitation by its name, accounts/{account}/roles/{role}. A name another role of the account has is ALREADY_EXISTS on display_name; nobody may define a role wider than their own: that is PERMISSION_DENIED.
path Parameters
account_idId of the parent account.
Create role › Request Body
display_nameThe role's name, as member pickers show it — unique in the account, surrounding spaces dropped, at most 100 characters. A second role of the same name is ALREADY_EXISTS. The list is ordered by it.
descriptionWhat the role is for, in a sentence a member picker can show next to the choice; at most 1000 characters, empty when there is none.
grantsWhat the role holds, as {permission, level} — a section id from permissions and READ or WRITE. A grant covers the section's whole subtree and brings its implies along. Every member holding the role holds exactly these, and a change counts from their next request. Nobody may define a role wider than their own: that is PERMISSION_DENIED.
Create role › Responses
The created resource.
nameThe resource name (§5) — the identity of this resource, and the path that addresses it: websites/{website}/cms_pages/{cms_page}. It is the handle to store, not a human label.
idThe last segment of name on its own, for a client that needs to build a child URL. Unique inside its parent, never across the platform.
create_timeWhen the resource was created (RFC 3339, UTC).
update_timeWhen the resource last changed (RFC 3339, UTC).
etagVersion of the persisted state. Send it back in If-Match on Update or Delete and the write is rejected with ABORTED if anyone else changed the resource meanwhile (§14).
display_nameThe role's name, as member pickers show it — unique in the account, surrounding spaces dropped, at most 100 characters. A second role of the same name is ALREADY_EXISTS. The list is ordered by it.
descriptionWhat the role is for, in a sentence a member picker can show next to the choice; at most 1000 characters, empty when there is none.
grantsWhat the role holds, as {permission, level} — a section id from permissions and READ or WRITE. A grant covers the section's whole subtree and brings its implies along. Every member holding the role holds exactly these, and a change counts from their next request. Nobody may define a role wider than their own: that is PERMISSION_DENIED.
member_countHow many members of the account hold the role now. A role that a member holds, or that an invitation names, cannot be deleted.
Get role
The account's own roles: named sets of grants, defined once and given to members and invitations by name — role: accounts/{account}/roles/{role} — beside the three roles every account has (roles). A member's rights follow the role, so changing its grants changes what every holder may do. Reading the roles takes the account.access section; defining, changing and deleting them takes writing it. A role that a member holds or an invitation names is not deleted, and deleting the account deletes its roles.
path Parameters
account_idId of the parent account.
role_idId of the parent role.
Headers
If-None-MatchA matching etag answers 304 with no body (§16).
Get role › Responses
The resource.
nameThe resource name (§5) — the identity of this resource, and the path that addresses it: websites/{website}/cms_pages/{cms_page}. It is the handle to store, not a human label.
idThe last segment of name on its own, for a client that needs to build a child URL. Unique inside its parent, never across the platform.
create_timeWhen the resource was created (RFC 3339, UTC).
update_timeWhen the resource last changed (RFC 3339, UTC).
etagVersion of the persisted state. Send it back in If-Match on Update or Delete and the write is rejected with ABORTED if anyone else changed the resource meanwhile (§14).
display_nameThe role's name, as member pickers show it — unique in the account, surrounding spaces dropped, at most 100 characters. A second role of the same name is ALREADY_EXISTS. The list is ordered by it.
descriptionWhat the role is for, in a sentence a member picker can show next to the choice; at most 1000 characters, empty when there is none.
grantsWhat the role holds, as {permission, level} — a section id from permissions and READ or WRITE. A grant covers the section's whole subtree and brings its implies along. Every member holding the role holds exactly these, and a change counts from their next request. Nobody may define a role wider than their own: that is PERMISSION_DENIED.
member_countHow many members of the account hold the role now. A role that a member holds, or that an invitation names, cannot be deleted.
Delete role
Deletes a role nobody holds. While a member holds it, or an invitation — pending or expired — names it, the answer is FAILED_PRECONDITION: give those members another role and withdraw those invitations first.
path Parameters
account_idId of the parent account.
role_idId of the parent role.
Headers
If-MatchThe etag the client last read. A mismatch is ABORTED (409) with the current resource in the error details (§14).
Delete role › Responses
Deleted. No body (§7).
Update role
Changes a role's display_name, description or grants. Every member holding the role holds the new grants from their next request. The grants as they will be are weighed against the caller's own, all of them: a role wider than the caller's is PERMISSION_DENIED.
path Parameters
account_idId of the parent account.
role_idId of the parent role.
query Parameters
update_maskComma-separated field paths to merge. A field named here and sent as null is cleared; without the mask a null is dropped (§7, §11).
Headers
If-MatchThe etag the client last read. A mismatch is ABORTED (409) with the current resource in the error details (§14).
Update role › Request Body
display_nameThe role's name, as member pickers show it — unique in the account, surrounding spaces dropped, at most 100 characters. A second role of the same name is ALREADY_EXISTS. The list is ordered by it.
descriptionWhat the role is for, in a sentence a member picker can show next to the choice; at most 1000 characters, empty when there is none.
grantsWhat the role holds, as {permission, level} — a section id from permissions and READ or WRITE. A grant covers the section's whole subtree and brings its implies along. Every member holding the role holds exactly these, and a change counts from their next request. Nobody may define a role wider than their own: that is PERMISSION_DENIED.
Update role › Responses
The updated resource.
nameThe resource name (§5) — the identity of this resource, and the path that addresses it: websites/{website}/cms_pages/{cms_page}. It is the handle to store, not a human label.
idThe last segment of name on its own, for a client that needs to build a child URL. Unique inside its parent, never across the platform.
create_timeWhen the resource was created (RFC 3339, UTC).
update_timeWhen the resource last changed (RFC 3339, UTC).
etagVersion of the persisted state. Send it back in If-Match on Update or Delete and the write is rejected with ABORTED if anyone else changed the resource meanwhile (§14).
display_nameThe role's name, as member pickers show it — unique in the account, surrounding spaces dropped, at most 100 characters. A second role of the same name is ALREADY_EXISTS. The list is ordered by it.
descriptionWhat the role is for, in a sentence a member picker can show next to the choice; at most 1000 characters, empty when there is none.
grantsWhat the role holds, as {permission, level} — a section id from permissions and READ or WRITE. A grant covers the section's whole subtree and brings its implies along. Every member holding the role holds exactly these, and a change counts from their next request. Nobody may define a role wider than their own: that is PERMISSION_DENIED.
member_countHow many members of the account hold the role now. A role that a member holds, or that an invitation names, cannot be deleted.
Accept (invitations)
Accepts an invitation: send the link's token. For a registered address, call it signed in as that address (Authorization: Bearer …) — another user's session is PERMISSION_DENIED, no session UNAUTHENTICATED. For an address nobody is registered with, send a password (at least 8 characters) and, if you like, firstname and lastname: the user is made, and the answer carries their first session token. Either way the answer has the user and the account they joined, and the invitation is used up.
Accept (invitations) › Request Body optional
Accept (invitations) › Responses
The affected resource, or the method’s own response object (§10).
Inspect (invitations)
Reads what an invitation link is for, without signing in: send the link's {"token": "…"}. Answers account_display_name, the invited email, the role the membership will hold, expire_time and user_exists — whether the address is registered, which decides how it is accepted. A link that is wrong, expired, withdrawn or already used is NOT_FOUND, all alike.
Inspect (invitations) › Request Body optional
Inspect (invitations) › Responses
The affected resource, or the method’s own response object (§10).
List permissions
The sections of the product a right can be granted on, as a tree: each has an id a grant names ({permission, level}, with level READ or WRITE — writing includes reading), and a grant on a section covers everything under it. Listed in tree order, each section right after its parent. Nothing here is stored or writable: it is the platform's catalogue, and a section a new release adds shows up here — and in every role that holds its parent — without anyone editing a role.
query Parameters
page_sizeRows per page. Over the maximum is clamped, not rejected.
page_tokenOpaque token from a previous next_page_token. A token minted under a different order_by/filter is rejected.
skipRows to skip before the page (AIP-158). skip + page_size is capped at 10000; beyond that is OUT_OF_RANGE.
order_byComma-separated field [asc|desc], at most 3 keys. Default: create_time desc. Sortable: none — this collection serves its documented order only.
filterAIP-160 subset (§8). Filterable: none. A field outside the list is INVALID_ARGUMENT.
List permissions › Responses
One page of permissions.
This page of permissions, in the requested order.
next_page_tokenOpaque. Absent or empty means this was the last page.
total_sizeRows in the whole filtered collection, not in this page.
Get permission
The sections of the product a right can be granted on, as a tree: each has an id a grant names ({permission, level}, with level READ or WRITE — writing includes reading), and a grant on a section covers everything under it. Listed in tree order, each section right after its parent. Nothing here is stored or writable: it is the platform's catalogue, and a section a new release adds shows up here — and in every role that holds its parent — without anyone editing a role.
path Parameters
permission_idId of the parent permission.
Headers
If-None-MatchA matching etag answers 304 with no body (§16).
Get permission › Responses
The resource.
nameThe resource name (§5) — the identity of this resource, and the path that addresses it: websites/{website}/cms_pages/{cms_page}. It is the handle to store, not a human label.
idThe last segment of name on its own, for a client that needs to build a child URL. Unique inside its parent, never across the platform.
create_timeWhen the resource was created (RFC 3339, UTC).
update_timeWhen the resource last changed (RFC 3339, UTC).
etagVersion of the persisted state. Send it back in If-Match on Update or Delete and the write is rejected with ABORTED if anyone else changed the resource meanwhile (§14).
parentThe section this one belongs to, as its resource name. Absent on the two roots — account, everything about the account itself, and website, everything inside its websites. A grant on a section covers every section under it.
display_nameThe section's name as a person reads it, in English. tenant-admin shows its own translation, looked up by id, and falls back to this one.
descriptionWhat a grant on this section lets a member do, in a sentence or two a role editor can show as help text.
readable_by_all_membersTrue where every member of the account may read without any grant — everything inside the websites, and the account's settings and projects — so that every picker works under every role. On such a section a READ grant only decides whether it shows in the menu; changing anything still takes WRITE.
impliesThe grants holding this section brings along, as {when, permission, level}: whoever holds when (READ or WRITE) on this section — or on a section above it — holds level on permission too. It is what keeps a narrow role usable: writing a theme uploads its logo, so it brings writing to the media library with it. Empty on most sections.
List roles
The three roles every account has without defining them, which a membership names in its role: roles/admin — everything in the account, access management included, but not the owner's own acts; roles/editor — everything but access management; and roles/sections — only the sections its membership grants. The account's owner holds everything whatever the role says, and is the only one who may delete the account. Website content stays readable under every role, so pickers work; changing it takes a grant. An account defines roles of its own under accounts/{account}/roles.
query Parameters
page_sizeRows per page. Over the maximum is clamped, not rejected.
page_tokenOpaque token from a previous next_page_token. A token minted under a different order_by/filter is rejected.
skipRows to skip before the page (AIP-158). skip + page_size is capped at 10000; beyond that is OUT_OF_RANGE.
order_byComma-separated field [asc|desc], at most 3 keys. Default: create_time desc. Sortable: none — this collection serves its documented order only.
filterAIP-160 subset (§8). Filterable: none. A field outside the list is INVALID_ARGUMENT.
List roles › Responses
One page of roles.
This page of roles, in the requested order.
next_page_tokenOpaque. Absent or empty means this was the last page.
total_sizeRows in the whole filtered collection, not in this page.
Get role
The three roles every account has without defining them, which a membership names in its role: roles/admin — everything in the account, access management included, but not the owner's own acts; roles/editor — everything but access management; and roles/sections — only the sections its membership grants. The account's owner holds everything whatever the role says, and is the only one who may delete the account. Website content stays readable under every role, so pickers work; changing it takes a grant. An account defines roles of its own under accounts/{account}/roles.
path Parameters
role_idId of the parent role.
Headers
If-None-MatchA matching etag answers 304 with no body (§16).
Get role › Responses
The resource.
nameThe resource name (§5) — the identity of this resource, and the path that addresses it: websites/{website}/cms_pages/{cms_page}. It is the handle to store, not a human label.
idThe last segment of name on its own, for a client that needs to build a child URL. Unique inside its parent, never across the platform.
create_timeWhen the resource was created (RFC 3339, UTC).
update_timeWhen the resource last changed (RFC 3339, UTC).
etagVersion of the persisted state. Send it back in If-Match on Update or Delete and the write is rejected with ABORTED if anyone else changed the resource meanwhile (§14).
display_nameThe role's name as a person reads it, in English.
descriptionWhat a member with this role may do, in a sentence or two a member picker can show next to the choice.
grantsWhat the role holds, as {permission, level} — computed from permissions on every read rather than stored, so a section a new release adds is in roles/admin and roles/editor the day it ships. Minimal: no grant that another one already covers, and implies already followed. Empty for roles/sections, whose grants are each membership's own.