# Get Role Capabilities

See what a role lets its members do in Cirra: web search, files, shell commands, and each app, model, or action.

`GET https://connect.mindcloud.co/v2/roles/:roleId/capabilities`

Permissions: `member:view`.

## Parameters

### Path

- `roleId` (string, required): The role's id, from List Roles.

### Headers

- `X-Company-Id` (string): Optional. The id of the organization to act in. Leave it out to act in the API key's own organization. A key can also act in its child organizations, and, with "Use this key across all of your organizations" on, in every organization its creator can open in the app. List them with GET /v2/companies. Every response's X-Company-Id header names the organization it acted in. See [Organizations](https://mindcloud.co/docs/api/rest/introduction/organizations).

## Example request

```bash
curl --request GET \
  --url 'https://connect.mindcloud.co/v2/roles/Rl5wB9cF3hJp/capabilities' \
  --header 'Authorization: Bearer $MINDCLOUD_API_TOKEN'
```

## Response fields

- `roleId` (string): The role.
- `capabilities` (array of objects): Every rule the role sets, in key order. A key it does not set follows its fallback (Get Capability Catalog).
  - `key` (string): The capability key, such as apps.salesforce.contact.delete.
  - `value` (string): allow or deny. A deny is a ceiling no member of the role can lift.
    Allowed values:
      - `allow`
      - `deny`