Skip to main content

Roles & Permissions

This category lists the 19 Runtime system commands under system.role..

1. List roles​

Full name: system.role.list

List role records. This tenant-scoped Runtime command validates its input against the registered command schema. · Risk: Read

sl system role list \
  [--keyword value] [--cursor value] [--limit n] [--json]

Parameters:

  • keyword（optional）— Matches role name, code, and description; at most 200 characters
  • cursor（optional）— Opaque nextCursor returned by the previous request
  • limit（optional）— Maximum rows to return, 1-100; defaults to 20

2. Retrieve role​

Full name: system.role.get

Retrieve role resource. This tenant-scoped Runtime command validates its input against the registered command schema. · Risk: Read

sl system role get --role-id <uuid> [--json]

Parameters:

  • roleId（required）— Exact role UUID returned by system.role.list

3. Create role​

Full name: system.role.create

Create role resource. This tenant-scoped Runtime command validates its input against the registered command schema. · Risk: Write

sl system role create \
  (--definition-json json|--definition-file path) [--json]

Parameters:

  • code（required）— Immutable lowercase role code: 2-64 letters, digits, or underscores; starts with a letter
  • name（required）— Role display name, 1-200 characters
  • description（optional）— Optional description, null clears it

4. Duplicate role​

Full name: system.role.duplicate

Duplicate role resource. This tenant-scoped Runtime command validates its input against the registered command schema. · Risk: Write

sl system role duplicate \
  --source-role-id <uuid> \
  (--definition-json json|--definition-file path) [--json]

Parameters:

  • sourceRoleId（required）— Editable source role UUID; authorization roles require a space administrator
  • code（required）— Unique code for the new role
  • name（required）— Display name for the new role
  • description（optional）— Description for the new role

5. Update role​

Full name: system.role.update

Update role resource. This tenant-scoped Runtime command validates its input against the registered command schema. · Risk: Write

sl system role update \
  --role-id <uuid> (--definition-json json|--definition-file path) \
  [--json]

Parameters:

  • roleId（required）— Exact role UUID returned by system.role.list
  • name|description|status（required）— Provide at least one change. status is active or disabled

6. Delete role​

Full name: system.role.delete

Delete role resource. This tenant-scoped Runtime command validates its input against the registered command schema. · Risk: High risk

sl system role delete --role-id <uuid> [--json]

Parameters:

  • roleId（required）— Exact role UUID returned by system.role.list

7. List bindings​

Full name: system.role.binding.list

List role binding records. This tenant-scoped Runtime command validates its input against the registered command schema. · Risk: Read

sl system role binding list --role-id <uuid> [--json]

Parameters:

  • roleId（required）— Exact role UUID returned by system.role.list

8. Create binding​

Full name: system.role.binding.create

Create role binding resource. This tenant-scoped Runtime command validates its input against the registered command schema. · Risk: Write

sl system role binding create \
  --role-id <uuid> (--definition-json json|--definition-file path) \
  [--json]

Parameters:

  • roleId（required）— Exact role UUID returned by system.role.list
  • principalType（required）— MEMBER, DEPARTMENT, or ORGANIZATION
  • principalId（required）— Existing tenant principal UUID matching principalType
  • enabled（optional）— Defaults to true
  • startAt|endAt（optional）— Optional ISO timestamps with offsets. endAt must be later than startAt

9. Update binding​

Full name: system.role.binding.update

Update role binding resource. This tenant-scoped Runtime command validates its input against the registered command schema. · Risk: Write

sl system role binding update \
  --role-id <uuid> --binding-id <uuid> \
  (--definition-json json|--definition-file path) [--json]

Parameters:

  • roleId（required）— Exact role UUID returned by system.role.list
  • bindingId（required）— Binding UUID returned by binding.list
  • enabled|startAt|endAt（required）— Provide at least one change. null removes a time boundary

10. Delete binding​

Full name: system.role.binding.delete

Delete role binding resource. This tenant-scoped Runtime command validates its input against the registered command schema. · Risk: High risk

sl system role binding delete \
  --role-id <uuid> --binding-id <uuid> [--json]

Parameters:

  • roleId（required）— Exact role UUID returned by system.role.list
  • bindingId（required）— Binding UUID returned by binding.list

11. Retrieve permission editor​

Full name: system.role.permission.editor.get

Retrieve role permission editor resource. This tenant-scoped Runtime command validates its input against the registered command schema. · Risk: Read

sl system role permission editor get --role-id <uuid> [--json]

Parameters:

  • roleId（required）— Exact role UUID returned by system.role.list

12. Replace permission​

Full name: system.role.permission.replace

Replace role permission resource. This tenant-scoped Runtime command validates its input against the registered command schema. · Risk: Write

sl system role permission replace \
  --role-id <uuid> (--definition-json json|--definition-file path) \
  [--json]

Parameters:

  • roleId（required）— Exact role UUID returned by system.role.list
  • permissionCategory（optional）— feature or resource. Omit only for a deliberate full replacement
  • entries（required）— Complete permission entries for the selected category or for the whole role when category is omitted. Newly added allows must be permissions the caller already holds

13. Explain permission​

Full name: system.role.permission.explain

Explain role permission resource. This tenant-scoped Runtime command validates its input against the registered command schema. · Risk: Read

sl system role permission explain \
  (--definition-json json|--definition-file path) [--json]

Parameters:

  • subjectType（required）— MEMBER, DEPARTMENT, or ORGANIZATION
  • subjectId（required）— Existing subject UUID matching subjectType
  • formId（optional）— Optional form UUID for form-level evaluation
  • recordId（optional）— Optional record UUID. Requires formId and enables row-policy explanation

14. Retrieve data policy editor​

Full name: system.role.data-policy.editor.get

Retrieve role data policy editor resource. This tenant-scoped Runtime command validates its input against the registered command schema. · Risk: Read

sl system role data-policy editor get \
  --role-id <uuid> --form-id <uuid> [--json]

Parameters:

  • roleId（required）— Exact role UUID returned by system.role.list
  • formId（required）— Exact form UUID

15. Replace data policy​

Full name: system.role.data-policy.replace

Replace role data policy resource. This tenant-scoped Runtime command validates its input against the registered command schema. · Risk: Write

sl system role data-policy replace \
  --role-id <uuid> --form-id <uuid> \
  (--definition-json json|--definition-file path) [--json]

Parameters:

  • roleId（required）— Exact role UUID returned by system.role.list
  • formId（required）— Form whose role data policies are fully replaced
  • entries（required）— Complete data-policy set for this role and form. Empty clears all non-system entries

16. List condition shares​

Full name: system.role.condition-share.list

List role condition share records. This tenant-scoped Runtime command validates its input against the registered command schema. · Risk: Read

sl system role condition-share list [--form-id <uuid>] [--json]

Parameters:

  • formId（optional）— Optional form UUID filter

17. Create condition share​

Full name: system.role.condition-share.create

Create role condition share resource. This tenant-scoped Runtime command validates its input against the registered command schema. · Risk: Write

sl system role condition-share create \
  (--definition-json json|--definition-file path) [--json]

Parameters:

  • definition（required）— Strict command definition; unknown fields are rejected

18. Update condition share​

Full name: system.role.condition-share.update

Update role condition share resource. This tenant-scoped Runtime command validates its input against the registered command schema. · Risk: Write

sl system role condition-share update \
  --rule-id <uuid> (--definition-json json|--definition-file path) \
  [--json]

Parameters:

  • ruleId（required）— Condition-share rule UUID returned by list
  • definition（required）— Strict command definition; unknown fields are rejected

19. Delete condition share​

Full name: system.role.condition-share.delete

Delete role condition share resource. This tenant-scoped Runtime command validates its input against the registered command schema. · Risk: High risk

sl system role condition-share delete --rule-id <uuid> [--json]

Parameters:

  • ruleId（required）— Condition-share rule UUID returned by list