# Get an environment role

`GET /v1/roles/{role_id}` · permission `roles:read`

Returns the role. The response carries an `ETag` to use with `If-Match`.

## Request

| Field | Type | Required | Description |
|---|---|---|---|
| `role_id` | path | yes | Role ID (`rol_…`). |

No request body.

## Response

`200 OK` with the role.

```json
{
  "id": "rol_01j9xr7s1t2w6x8y0z2a4b6c8e",
  "organization_id": null,
  "key": "support",
  "name": "Support",
  "description": "",
  "is_privileged": false,
  "assignable_in_self_service": true,
  "permission_ids": [],
  "created_at": "2026-10-12T09:31:00.123456Z",
  "updated_at": "2026-10-12T09:31:00.123456Z",
  "version": 1
}
```

## Errors

| HTTP | code | When |
|---|---|---|
| 404 | `not_found` | The role does not exist in this environment, or it belongs to an organization. |
| 401 | `unauthenticated` | The credential is missing, invalid or revoked. |
| 403 | `insufficient_permissions` | The credential lacks the required permission. |
| 429 | `rate_limited` | The rate limit was exceeded; retry after the `Retry-After` period. |
| 503 | `service_unavailable` | A dependency is temporarily unavailable; retry after the `Retry-After` period. |

## Example

```bash
curl -i "https://api.eu.keenauth.com/v1/roles/rol_01j9xr7s1t2w6x8y0z2a4b6c8e" \
  -H "Authorization: Bearer $KEENAUTH_SECRET_KEY"
```