### List roles

`GET /api/v1/roles`

Every role visible to the tenant, with its permission count and the exact code set it grants. System roles sort first.

- Authentication: manager session (JWT) or API token
- Permission: `prm_roles_manage` (Manage roles & permissions)
- Risk: danger

#### Response — 200 OK

```json
{
  "data": [
    {
      "id": 2,
      "tenant_id": 12,
      "name": "support",
      "description": "Read subscribers, reply to tickets",
      "is_system": false,
      "template_key": "support",
      "immutable": false,
      "permission_count": 14,
      "permissions": ["prm_tickets_reply", "prm_tickets_view", "prm_users_index"]
    }
  ]
}
```

#### Note

Un-paginated. template_key is the provisioning slug a seeded role came from, and is null for a hand-made one — it is populated by this list only, not by the role pickers.