> ## Documentation Index > Fetch the complete documentation index at: https://api-docs.select.dev/llms.txt > Use this file to discover all available pages before exploring further. # Get a role a user holds > Get a single role the user holds, from any of its three sources. ## OpenAPI ````yaml https://api.select.dev/v2/openapi.json get /users/{email}/roles/{role_id} openapi: 3.1.0 info: title: SELECT API (v2) version: 0.1.0 servers: - url: https://api.select.dev/v2 description: SELECT API v2 security: [] paths: /users/{email}/roles/{role_id}: get: tags: - users summary: Get a role a user holds description: Get a single role the user holds, from any of its three sources. operationId: get_user_role_route_users__email__roles__role_id__get parameters: - name: email in: path required: true schema: type: string title: Email - name: role_id in: path required: true schema: type: string title: Role Id - name: x-tenant-id in: header required: true schema: type: string description: The organization ID the request is scoped to. title: X-Tenant-Id description: The organization ID the request is scoped to. responses: '200': description: Successful Response content: application/json: schema: $ref: '#/components/schemas/UserRoleGrantV2' '422': description: Validation Error content: application/json: schema: $ref: '#/components/schemas/HTTPValidationError' security: - HTTPBearer: [] components: schemas: UserRoleGrantV2: properties: id: type: string title: Id description: The unique identifier of this role grant. readOnly: true x-terraform-computed: true role: $ref: '#/components/schemas/AccessRole' description: The role the user holds. snowflake_organization_name: anyOf: - type: string - type: 'null' title: Snowflake Organization Name description: Snowflake organization this grant is scoped to, if any. snowflake_account_uuid: anyOf: - type: string - type: 'null' title: Snowflake Account Uuid description: Snowflake account this grant is scoped to, if any. usage_group_id: anyOf: - type: string - type: 'null' title: Usage Group Id description: Usage group this grant is scoped to, if any. entity: $ref: '#/components/schemas/PermissionEntityWithDisplayName' description: >- The resolved scope this grant applies to — its type, id and human readable display name. Falls back to the organization when the grant carries no narrower scope. readOnly: true x-terraform-computed: true is_default: type: boolean title: Is Default description: >- Whether this role applies to everyone in the organization by default rather than being granted to this user. readOnly: true x-terraform-computed: true granted_from_team_name: anyOf: - type: string - type: 'null' title: Granted From Team Name description: >- The team this role is inherited from, when the user holds it through team membership rather than directly. readOnly: true x-terraform-computed: true create_time: type: string title: Create Time description: When the role was granted — RFC 3339 UTC, e.g. 2026-06-05T10:30:00Z. readOnly: true x-terraform-computed: true update_time: type: string title: Update Time description: When the grant was last updated — RFC 3339 UTC. readOnly: true x-terraform-computed: true etag: type: string title: Etag description: Opaque strong ETag for optimistic concurrency. readOnly: true x-terraform-computed: true type: object required: - id - role - entity - is_default - granted_from_team_name - create_time - update_time - etag title: UserRoleGrant description: >- A role a user holds, with the scope it applies to. A user holds a role in one of three ways: granted to them directly, inherited from a team they belong to, or applied to everyone in the organization by default. Only a direct grant can be changed — the other two are edited at their source. HTTPValidationError: properties: detail: items: $ref: '#/components/schemas/ValidationError' type: array title: Detail type: object title: HTTPValidationError AccessRole: type: string enum: - admin - editor - monitor_editor - viewer - team_creator title: AccessRole description: The permission level a role grant confers. PermissionEntityWithDisplayName: properties: type: $ref: '#/components/schemas/PermissionEntityType' id: type: string title: Id display_name: type: string title: Display Name usage_group_details: anyOf: - $ref: '#/components/schemas/UsageGroupDetails' - type: 'null' parent_id: anyOf: - type: string - type: 'null' title: Parent Id type: object required: - type - id - display_name title: PermissionEntityWithDisplayName description: >- Permission entity with a human readable display name. Args: type: The type of the entity. `usage_group`, `snowflake_account`, `snowflake_organization`, `databricks_account`, `databricks_connection`, `team`, or `select_organization`. id: The id of the entity. The `usage_group_id`, `snowflake_account_uuid`, `snowflake_organization_name`, `databricks_account_id`, `databricks_conn_id`, `team_id`, or `organization_id`. display_name: A human readable name for the entity. Typically colon delimited. On this class the property is required. usage_group_details: Optional details about the usage group. Only included in serialization when type is USAGE_GROUP. Note that the hashing and equality check are done based on the `type` and `id` fields as per the `PermissionEntity` class. This means that even if the `display_name` is different, two `PermissionEntityWithDisplayName` instances will still compare equal. ValidationError: properties: loc: items: anyOf: - type: string - type: integer type: array title: Location msg: type: string title: Message type: type: string title: Error Type type: object required: - loc - msg - type title: ValidationError PermissionEntityType: type: string enum: - select_organization - snowflake_organization - snowflake_account - databricks_account - databricks_connection - bigquery_connection - aws_account - tableau_site - team - usage_group title: PermissionEntityType description: >- The type of the permission entity. Comparison operations are supported to understand the level in the hierarchy of the type. NOTE: The object hierarchy is not linear. SELECT Organizations are still at the top, but teams and usage groups are effectively the same level, but will return false if compared. Hierarchy (see ``grants.CONTAINS`` for the authoritative tree): SELECT_ORGANIZATION ├── SNOWFLAKE_ORGANIZATION │ └── SNOWFLAKE_ACCOUNT │ └── USAGE_GROUP ├── DATABRICKS_ACCOUNT │ └── DATABRICKS_CONNECTION ├── BIGQUERY_CONNECTION ├── AWS_ACCOUNT ├── TABLEAU_SITE ├── TEAM │ └── USAGE_GROUP └── USAGE_GROUP UsageGroupDetails: properties: set_name: type: string title: Set Name group_name: type: string title: Group Name type: object required: - set_name - group_name title: UsageGroupDetails description: |- Details about a usage group entity. This is only populated when the entity type is USAGE_GROUP. securitySchemes: HTTPBearer: type: http description: Organization API key (sl_…). scheme: bearer ````