The role service allows administrators to view, create, edit, and delete role definitions. However, the role service does not define role membership. To add users to a role, edit the user’s properties, as described in Editing a User.

The GET method of the role service returns descriptors for all roles that match the search string. In commercial editions, the scope of the search is the administrator’s organization and all suborganizations. In the community project, there are no organizations, and the scope is all roles defined in the server. If no search string is specified, all roles are returned. If no roles match the search string, the method returns an empty list.

In commercial editions, roles defined in an organization specify its ID in the tenantID element. System roles that appear in every organization are listed without a tenantID property. The community project does not have organizations and thus does not specify the tenantId element on any roles.