> ## Documentation Index
> Fetch the complete documentation index at: https://support.i.moneyforward.com/llms.txt
> Use this file to discover all available pages before exploring further.

# List the app roles of an IdP-managed app

> Returns the app roles defined on the identity provider for an IdP-managed app workspace, read live from the identity provider. Use a role's id as appRoleId when assigning the app. Only enabled roles are returned unless includeDisabled is true. Workspaces not managed by an identity provider return 400.



## OpenAPI

````yaml https://api.itmc.i.moneyforward.com/public-api/docs/v1-json get /api/v1/organizations/{organizationId}/workspaces/{workspaceId}/idp-app-assignments/app-roles
openapi: 3.0.0
info:
  title: Admina Public API
  description: >-
    Admina API is a RESTful API providing programmatic access to much of the
    data in the system. It provides predictable URLs for accessing resources,
    and uses built-in HTTP features to receive commands and return responses.
    This makes it easy to communicate with from a wide variety of environments,
    from command-line utilities to gadgets to the browser URL bar itself.
  version: '1.0'
  contact: {}
servers:
  - url: https://api.itmc.i.moneyforward.com
security: []
tags:
  - name: Organizations
    description: ''
  - name: Users
    description: ''
  - name: Directory
    description: ''
  - name: Departments
    description: ''
  - name: Locations
    description: ''
  - name: Companies
    description: ''
  - name: Structures
    description: ''
  - name: People
    description: ''
  - name: People Stats
    description: ''
  - name: Employee Masters
    description: ''
  - name: Workspaces
    description: ''
  - name: Custom Service and Workspace
    description: ''
  - name: Custom Services
    description: ''
  - name: Workspace Accounts
    description: ''
  - name: Workspace Licenses
    description: ''
  - name: Accounts
    description: ''
  - name: Contracts
    description: ''
  - name: Devices
    description: ''
  - name: Devices (alpha)
    description: ''
  - name: Alerts
    description: ''
  - name: Spends
    description: ''
  - name: Usage Optimization
    description: ''
  - name: Services
    description: ''
  - name: Service Roles
    description: ''
  - name: Service Licenses
    description: ''
  - name: Recommended Services
    description: ''
  - name: Requests
    description: ''
  - name: AuditLogs
    description: ''
  - name: EventLogs
    description: ''
paths:
  /api/v1/organizations/{organizationId}/workspaces/{workspaceId}/idp-app-assignments/app-roles:
    get:
      tags:
        - Services
      summary: List the app roles of an IdP-managed app
      description: >-
        Returns the app roles defined on the identity provider for an
        IdP-managed app workspace, read live from the identity provider. Use a
        role's id as appRoleId when assigning the app. Only enabled roles are
        returned unless includeDisabled is true. Workspaces not managed by an
        identity provider return 400.
      operationId: publicGetIdpAppRoles
      parameters:
        - name: organizationId
          required: true
          in: path
          schema:
            type: number
        - name: workspaceId
          required: true
          in: path
          schema:
            type: number
        - name: includeDisabled
          required: false
          in: query
          description: >-
            Also return roles that are disabled on the identity provider.
            Disabled roles cannot be assigned, so they are left out by default.
          schema:
            default: false
            type: boolean
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PublicGetIdpAppRolesResponseDto'
        '400':
          description: Workspace is not managed by an identity provider
        '401':
          description: Invalid or missing API key
      security:
        - API-Key: []
components:
  schemas:
    PublicGetIdpAppRolesResponseDto:
      type: object
      properties:
        appRoles:
          readOnly: true
          type: array
          items:
            $ref: '#/components/schemas/PublicIdpAppRoleDto'
      required:
        - appRoles
    PublicIdpAppRoleDto:
      type: object
      properties:
        id:
          type: string
          example: 3f2504e0-4f89-41d3-9a0c-0305e82c3301
          description: >-
            The identity provider's app role ID (a GUID for Microsoft Entra ID).
            Pass it as appRoleId.
        displayName:
          type: string
          example: Reader
          description: The role's display name.
        value:
          type: string
          nullable: true
          example: reader
          description: >-
            The role's value as defined on the identity provider. Distinct from
            displayName; null when unset.
        isEnabled:
          type: boolean
          example: true
          description: >-
            Whether the role is enabled on the identity provider. Only enabled
            roles can be assigned.
        description:
          type: string
          description: The role's description, when the provider has one.
      required:
        - id
        - displayName
        - value
        - isEnabled
  securitySchemes:
    API-Key:
      scheme: bearer
      bearerFormat: JWT
      type: http
      description: >-
        For authenticated requests, set the `Authorization: Bearer your_api_key`
        parameter in the header. <br/>You can create and manage your API Keys by
        visiting the **API Keys** tab in the **Settings** page of your
        organization in <a target='_blank' rel='noopener noreferrer'
        href='https://itmc.i.moneyforward.com/'>Admina</a>

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.