Roles

Returns every role under /org-{kcOrgId}/, including the seeded admin and member built-ins (flagged with is_builtin=true). Each entry includes the resolved permission list and the count of users assigned to the role.

Creates a child group under /org-{kcOrgId}/ with the supplied permissions as client-role composites. Built-in names ("admin", "member") are reserved. Each permission must be in the catalog and assignable (not system-only).

Returns one role's permission list + assignment count. 404 when the role belongs to a different organization (cross-tenant guard).

Removes the role's group from the org tree. Refuses if the role still has members assigned (reassign first) or if it's a built-in.

Replaces the role's composite client-role mappings with the supplied permission list. Bumps notBefore on every member of the group so the change reflects in their next refresh-token call. Built-ins cannot be modified.