> ## Documentation Index
> Fetch the complete documentation index at: https://api-docs.helpyousponsor.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Read an access role and allowed transitions

> Requires a signed-in team user, the team_access_roles_v1 rollout and Manage Access roles (`groups`). API keys remain accepted by route middleware but cannot replace the user actor required by this controller. The editor schema describes current capabilities, restrictions, scopes and advisory transition choices; mutations recheck all decisions.



## OpenAPI

````yaml get /admin/access/roles/{role_id}
openapi: 3.0.0
info:
  title: Gratona API
  description: >-
    REST API for the Gratona fundraising platform, including donor, donation,
    sponsorship, program, event, and integration workflows. Endpoints are
    organized by tag. Most endpoints require either a Passport bearer token or
    an issued API key — see the Security Schemes section.
  contact:
    name: Gratona Engineering
    url: https://gratona.com
    email: devs@gratona.com
  version: 1.0.0
servers:
  - url: https://api.gratona.com/v1
    description: Server Version 1.0.0
security: []
tags:
  - name: Auth
    description: >-
      Login, signup, logout, password reset, and email verification for admin
      users and donors.
  - name: Donors
    description: >-
      Donor records: CRUD, profile fields, household linkage, search, filters,
      merge, and duplicate detection.
  - name: Donations
    description: >-
      Individual donation records, recurring commitments, soft credits, refunds,
      designations, and exports.
  - name: Sponsorships
    description: >-
      Donor-to-entity commitment relationships, lifecycle transitions, and
      commitment-specific filters.
  - name: Entities
    description: >-
      Recipient records (children, families, projects, animals, etc.), their
      status, and entity-level fields.
  - name: Programs
    description: >-
      Program / campaign configuration: hierarchy, settings, and program-level
      metadata.
  - name: Forms
    description: >-
      Custom form builder (HysForm), form fields, standardized donor fields, and
      field migrations.
  - name: Trips
    description: >-
      Mission-trip management: trips, participants, budgets, tasks,
      e-signatures, fundraising milestones, and background checks.
  - name: Communications
    description: >-
      Email templates, SMS, newsletters, donor email manager, and per-donor
      notes.
  - name: Payments
    description: >-
      Payment-gateway management (Stripe, PayPal, Flutterwave, QuickBooks).
      Excludes inbound webhooks — see the Webhooks tag.
  - name: Reports
    description: Dashboards, analytics, scheduled reports, and exports.
  - name: Admin
    description: >-
      Client-account administration: users, groups/permissions, settings,
      integrations, and account lifecycle.
  - name: Donor Portal
    description: >-
      Endpoints consumed by the donor-facing portal (donor login, dashboard,
      donation history, messages).
  - name: Recipient Portal
    description: Endpoints consumed by the recipient-facing portal.
  - name: Public
    description: >-
      Unauthenticated public endpoints: donor signup, public trip pages,
      peer-to-peer campaigns, public checkout.
  - name: Webhooks
    description: >-
      Inbound webhooks from third parties (Stripe, PayPal, Flutterwave, Checkr,
      DropboxSign). Annotated minimally for reference; payload shapes are owned
      by the upstream provider.
  - name: Events
    description: >-
      Event setup, invitations, registration, ticketing, attendance and event
      reporting.
  - name: Journeys
    description: >-
      Journey graphs, activation, enrollment, message templates and event
      follow-up automations.
  - name: Tasks
    description: Workspace tasks, assignments, saved task views and record collaboration.
  - name: Fundraising
    description: >-
      Fundraising portfolios, stewardship plans, giving anniversaries and
      personal donor follow-up.
  - name: Impact Stories
    description: Story intake, review, assets, consent and publication workflows.
  - name: Integrations
    description: Workspace integration connections, mappings, synchronization and recovery.
  - name: Email Calendar
    description: Connected email/calendar accounts and donor interactions.
  - name: Spaces
    description: Workspace Spaces and collaborative Pages.
  - name: Library
    description: Workspace documents, source connections, files and analysis.
  - name: Intelligence
    description: Donor intelligence and Tali workspace workflows.
  - name: Automation
    description: >-
      V3 automation primitive discovery, input validation, invocation and Zapier
      contracts.
  - name: Schema
    description: V3 model, enum, capability and scope discovery.
  - name: Zapier
    description: Zapier automation connections, polling feeds and actions.
  - name: Files
    description: Files
  - name: Client
    description: Client
  - name: Payment Gateways
    description: Payment Gateways
  - name: Email Settings
    description: Email Settings
  - name: Admin Dashboard
    description: Admin Dashboard
  - name: Recipients
    description: Recipients
  - name: Historical Archived Updates
    description: Historical Archived Updates
  - name: Team & access
    description: Team & access
  - name: Settings
    description: Settings
  - name: Notifications
    description: Notifications
  - name: Participation
    description: Participation
  - name: Users
    description: Users
  - name: Wrapped
    description: Wrapped
  - name: Donor SignUp
    description: Donor SignUp
  - name: Frontend
    description: Frontend
  - name: User
    description: User
  - name: Workspace
    description: Workspace
paths:
  /admin/access/roles/{role_id}:
    get:
      tags:
        - Admin
      summary: Read an access role and allowed transitions
      description: >-
        Requires a signed-in team user, the team_access_roles_v1 rollout and
        Manage Access roles (`groups`). API keys remain accepted by route
        middleware but cannot replace the user actor required by this
        controller. The editor schema describes current capabilities,
        restrictions, scopes and advisory transition choices; mutations recheck
        all decisions.
      operationId: docAccessShowRoleGET
      parameters:
        - name: role_id
          in: path
          description: Role id.
          required: true
          schema:
            type: integer
            minimum: 1
          example: 123
      responses:
        '200':
          description: Read an access role and allowed transitions response.
          content:
            application/json:
              schema:
                properties:
                  data:
                    properties:
                      version:
                        type: integer
                      can_manage:
                        type: boolean
                      role:
                        $ref: '#/components/schemas/WorkspaceAccessRoleDoc'
                      allowed_transitions:
                        properties:
                          can_edit:
                            type: boolean
                          can_delete:
                            type: boolean
                          can_assign:
                            type: boolean
                          is_full_access_locked:
                            type: boolean
                          requires_expected_version:
                            type: boolean
                          advisory:
                            type: boolean
                        type: object
                    type: object
                type: object
        '401':
          description: Missing or invalid bearer token or API key.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '403':
          description: >-
            The caller lacks the required permission, resource access or feature
            availability.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '404':
          description: >-
            The organization-owned resource or parent was not found or is not
            available for this operation.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotFoundResponse'
      security:
        - bearerAuth: []
        - apiKeyAuth: []
components:
  schemas:
    WorkspaceAccessRoleDoc:
      properties:
        id:
          type: integer
        name:
          type: string
        is_full_access:
          type: boolean
        member_count:
          type: integer
        version:
          type: integer
        access_summary:
          properties:
            level:
              type: string
            source:
              type: string
            label:
              type: string
          type: object
        members:
          type: array
          items:
            $ref: '#/components/schemas/WorkspaceAccessMemberDoc'
        stored_permissions:
          description: >-
            Map of registered permission keys and canonical stored values.
            Dynamic scope keys are returned by editor_schema.
          type: object
          additionalProperties:
            type: string
            enum:
              - '0'
              - '1'
        effective_access:
          $ref: '#/components/schemas/WorkspaceAccessEffectiveMapDoc'
        access_by_area:
          $ref: '#/components/schemas/WorkspaceAccessAreaMapDoc'
        restrictions:
          type: array
          items:
            type: string
        editor_schema:
          $ref: '#/components/schemas/WorkspaceAccessEditorDoc'
      type: object
    ErrorResponse:
      title: ErrorResponse
      description: >-
        Generic error envelope used by most controllers. Most error responses
        pair a human-readable `message` with `status: error`. Some endpoints
        additionally include `errors` (validator errors), `error` (legacy
        single-error string), `code`, or domain-specific context fields.
      required:
        - message
      properties:
        message:
          description: Human-readable error message.
          type: string
          example: Something went wrong. Please try again.
        status:
          description: >-
            Always the literal string `error` for failures. Some endpoints omit
            this field.
          type: string
          example: error
        error:
          description: Legacy single error code/string used by older endpoints.
          type: string
          example: invalid_request
          nullable: true
        code:
          description: >-
            Optional application-level error code (not all endpoints populate
            this).
          type: string
          example: DONOR_NOT_FOUND
          nullable: true
      type: object
    NotFoundResponse:
      title: NotFoundResponse
      description: >-
        Returned with HTTP 404 when a resource lookup misses (typically because
        the id doesn't exist OR is scoped to a different `client_id`). Note:
        many endpoints intentionally collapse 'not found' and 'forbidden' into a
        single 404 to avoid leaking which records exist in another tenant.
      required:
        - message
      properties:
        message:
          description: >-
            Human-readable message. Often a more specific string like `Donor not
            found` or `Trip not found`.
          type: string
          example: Not Found
        status:
          type: string
          example: error
      type: object
    WorkspaceAccessMemberDoc:
      properties:
        id:
          type: integer
        name:
          type: string
        email:
          type: string
        is_active:
          type: boolean
        role_id:
          type: integer
        access_assignment_version:
          type: integer
      type: object
    WorkspaceAccessEffectiveMapDoc:
      description: >-
        Map keyed by canonical capability. Empty access maps serialize as an
        empty array when no role exists.
      type: object
      additionalProperties:
        properties:
          allowed:
            type: boolean
          source:
            type: string
          area:
            type: string
            nullable: true
          level:
            type: string
            nullable: true
        type: object
    WorkspaceAccessAreaMapDoc:
      type: object
      additionalProperties:
        properties:
          id:
            type: string
          area:
            type: string
          allowed:
            type: boolean
          level:
            type: string
          source:
            type: string
          reason:
            type: string
            nullable: true
        type: object
    WorkspaceAccessEditorDoc:
      properties:
        version:
          type: integer
        role_id:
          type: integer
        role_version:
          type: integer
        affected_member_count:
          type: integer
        editable:
          type: boolean
        reason:
          type: string
          nullable: true
        stored_permissions:
          description: >-
            Map of registered permission keys and canonical stored values.
            Dynamic scope keys are returned by editor_schema.
          type: object
          additionalProperties:
            type: string
            enum:
              - '0'
              - '1'
        stored_permissions_when_full_access_removed:
          description: >-
            Map of registered permission keys and canonical stored values.
            Dynamic scope keys are returned by editor_schema.
          type: object
          additionalProperties:
            type: string
            enum:
              - '0'
              - '1'
        sections:
          type: array
          items:
            properties:
              id:
                type: string
              title:
                type: string
              description:
                type: string
              type:
                type: string
              items:
                type: array
                items:
                  $ref: '#/components/schemas/WorkspaceAccessEditorItemDoc'
            type: object
      type: object
    WorkspaceAccessEditorItemDoc:
      properties:
        id:
          type: string
        type:
          type: string
        area:
          type: string
        label:
          type: string
        description:
          type: string
        key:
          type: string
          nullable: true
        key_prefix:
          type: string
          nullable: true
        kind:
          type: string
          nullable: true
        polarity:
          type: string
          nullable: true
        availability:
          type: string
          nullable: true
        resource_type:
          type: string
          nullable: true
        editable:
          type: boolean
        reason:
          type: string
          nullable: true
        editable_when_full_access_removed:
          type: boolean
        affected_member_count:
          type: integer
        version:
          type: integer
        keys:
          type: array
          items:
            type: string
        current:
          properties:
            stored:
              oneOf:
                - type: boolean
                - properties:
                    view:
                      type: boolean
                    manage:
                      type: boolean
                  type: object
            effective:
              type: boolean
            level:
              type: string
              nullable: true
            source:
              type: string
          type: object
        current_when_full_access_removed:
          properties:
            stored:
              oneOf:
                - type: boolean
                - properties:
                    view:
                      type: boolean
                    manage:
                      type: boolean
                  type: object
            effective:
              type: boolean
            level:
              type: string
              nullable: true
            source:
              type: string
          type: object
        allowed_values:
          type: array
          items:
            properties:
              value:
                oneOf:
                  - type: string
                  - type: boolean
              label:
                type: string
              enabled:
                type: boolean
              reason:
                type: string
                nullable: true
            type: object
        allowed_values_when_full_access_removed:
          type: array
          items:
            properties:
              value:
                oneOf:
                  - type: string
                  - type: boolean
              label:
                type: string
              enabled:
                type: boolean
              reason:
                type: string
                nullable: true
            type: object
        prerequisites:
          type: array
          items:
            properties:
              key:
                type: string
              label:
                type: string
            type: object
        resources:
          type: array
          items:
            properties:
              id:
                type: integer
              label:
                type: string
              key:
                type: string
              current:
                properties:
                  stored:
                    oneOf:
                      - type: boolean
                      - properties:
                          view:
                            type: boolean
                          manage:
                            type: boolean
                        type: object
                  effective:
                    type: boolean
                  level:
                    type: string
                    nullable: true
                  source:
                    type: string
                type: object
              current_when_full_access_removed:
                properties:
                  stored:
                    oneOf:
                      - type: boolean
                      - properties:
                          view:
                            type: boolean
                          manage:
                            type: boolean
                        type: object
                  effective:
                    type: boolean
                  level:
                    type: string
                    nullable: true
                  source:
                    type: string
                type: object
              allowed_values:
                type: array
                items:
                  properties:
                    value:
                      oneOf:
                        - type: string
                        - type: boolean
                    label:
                      type: string
                    enabled:
                      type: boolean
                    reason:
                      type: string
                      nullable: true
                  type: object
              editable:
                type: boolean
              reason:
                type: string
                nullable: true
              editable_when_full_access_removed:
                type: boolean
              allowed_values_when_full_access_removed:
                type: array
                items:
                  properties:
                    value:
                      oneOf:
                        - type: string
                        - type: boolean
                    label:
                      type: string
                    enabled:
                      type: boolean
                    reason:
                      type: string
                      nullable: true
                  type: object
            type: object
      type: object
  securitySchemes:
    bearerAuth:
      type: http
      description: Passport bearer token authentication for legacy admin sessions.
      scheme: bearer
      bearerFormat: JWT
    apiKeyAuth:
      type: apiKey
      description: Gratona API key sent with the compatibility header X-HYS-API-Key.
      name: X-HYS-API-Key
      in: header

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.