@dotcms/ai 26.8.14-1-next.2533 → 26.8.19-1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dotcms/ai",
-  "version": "26.8.14-1-next.2533",
+  "version": "26.08.19-01",
   "description": "The dotCMS agentic runtime — run model-written or human-written code safely against a dotCMS instance, with auth and policy owned in one place.",
   "repository": {
     "type": "git",

package/spec.cjs.js

@@ -4758,6 +4758,65 @@ var paths = {
 		}
 	},
 	"/api/v1/roles/{roleid}": {
+		"delete": {
+			description: "Deletes a role. The deletion CASCADES and is not reversible: the role is removed from all users that have it, all permissions granted to the role are deleted, and its layout (tool-group) assignments are detached. The response reports how many users were affected. Deletion is rejected when the role has child roles or is referenced by a workflow action's Assign To (409), and for system or locked roles (403).",
+			operationId: "deleteRole",
+			parameters: [
+				{
+					description: "Id of the role to delete",
+					"in": "path",
+					name: "roleid",
+					required: true,
+					schema: {
+						type: "string"
+					}
+				}
+			],
+			responses: {
+				"200": {
+					content: {
+						"application/json": {
+							schema: {
+								$ref: "#/components/schemas/ResponseEntityRoleDeletionView"
+							}
+						}
+					},
+					description: "Role deleted successfully; usersAffected reports the cascade blast radius"
+				},
+				"401": {
+					content: {
+						"application/json": {
+						}
+					},
+					description: "Unauthorized - authentication required"
+				},
+				"403": {
+					content: {
+						"application/json": {
+						}
+					},
+					description: "Forbidden - admin permissions required, or the role is a system or locked role"
+				},
+				"404": {
+					content: {
+						"application/json": {
+						}
+					},
+					description: "Role not found"
+				},
+				"409": {
+					content: {
+						"application/json": {
+						}
+					},
+					description: "Conflict - the role has child roles, or a workflow action references it"
+				}
+			},
+			summary: "Delete a role",
+			tags: [
+				"Roles"
+			]
+		},
 		get: {
 			description: "Load role based on the role id with optional children roles",
 			operationId: "loadRoleByRoleId",
@@ -4825,6 +4884,218 @@ var paths = {
 			tags: [
 				"Roles"
 			]
+		},
+		put: {
+			description: "Updates an existing role's name, key, description, can-grant flags and parent. PUT is a full replace: every field of the role is overwritten from the request body, so clients must send the complete role representation — omitted fields are reset (booleans default to false, omitted roleKey/description are cleared, omitted parentRoleId reparents to root). A null parentRoleId turns the role into a root role. Reparenting under the role's own descendant is rejected. System and locked roles cannot be updated. Note: the role is updated in place — grants and permissions attached to the role are preserved.",
+			operationId: "updateRole",
+			parameters: [
+				{
+					description: "Id of the role to update",
+					"in": "path",
+					name: "roleid",
+					required: true,
+					schema: {
+						type: "string"
+					}
+				}
+			],
+			requestBody: {
+				content: {
+					"application/json": {
+						schema: {
+							$ref: "#/components/schemas/RoleForm"
+						}
+					}
+				},
+				description: "Role information — same shape as POST /v1/roles",
+				required: true
+			},
+			responses: {
+				"200": {
+					content: {
+						"application/json": {
+							schema: {
+								$ref: "#/components/schemas/ResponseEntityRoleDetailView"
+							}
+						}
+					},
+					description: "Role updated successfully"
+				},
+				"400": {
+					content: {
+						"application/json": {
+						}
+					},
+					description: "Bad request - invalid role name, or the reparent would create a hierarchy cycle"
+				},
+				"401": {
+					content: {
+						"application/json": {
+						}
+					},
+					description: "Unauthorized - authentication required"
+				},
+				"403": {
+					content: {
+						"application/json": {
+						}
+					},
+					description: "Forbidden - admin permissions required, or the role is a system or locked role"
+				},
+				"404": {
+					content: {
+						"application/json": {
+						}
+					},
+					description: "Role or parent role not found"
+				},
+				"409": {
+					content: {
+						"application/json": {
+						}
+					},
+					description: "Conflict - duplicate role key, or duplicate role name under the same parent"
+				}
+			},
+			summary: "Update a role",
+			tags: [
+				"Roles"
+			]
+		}
+	},
+	"/api/v1/roles/{roleid}/users": {
+		"delete": {
+			description: "Bulk-removes the DIRECT membership of the given users from the role. The batch has PARTIAL-SUCCESS semantics: it never fails as a whole once the role resolves — every removable membership is removed and every other entry is reported in the skipped list with a reason: not_found (no user matches the id), inherited (the user is not a direct member — the membership is inherited through the role hierarchy, or the user is not a member at all; inherited membership can only be revoked by removing the user from the ancestor role that grants it), or error (unexpected per-user failure, logged server-side). Removals are committed per user, so entries already processed stay removed regardless of later entries.",
+			operationId: "removeUsersFromRole",
+			parameters: [
+				{
+					description: "Id of the role to remove users from",
+					"in": "path",
+					name: "roleid",
+					required: true,
+					schema: {
+						type: "string"
+					}
+				}
+			],
+			requestBody: {
+				content: {
+					"application/json": {
+						schema: {
+							$ref: "#/components/schemas/RoleUsersForm"
+						}
+					}
+				},
+				description: "Ids of the users to remove from the role",
+				required: true
+			},
+			responses: {
+				"200": {
+					content: {
+						"application/json": {
+							schema: {
+								$ref: "#/components/schemas/ResponseEntityRoleUsersRemovalView"
+							}
+						}
+					},
+					description: "Batch processed; removedUserIds and skipped report the per-user outcomes"
+				},
+				"400": {
+					content: {
+						"application/json": {
+						}
+					},
+					description: "Bad request - missing body, empty userIds, or null/blank entries"
+				},
+				"401": {
+					content: {
+						"application/json": {
+						}
+					},
+					description: "Unauthorized - authentication required"
+				},
+				"403": {
+					content: {
+						"application/json": {
+						}
+					},
+					description: "Forbidden - admin permissions required"
+				},
+				"404": {
+					content: {
+						"application/json": {
+						}
+					},
+					description: "Role not found"
+				}
+			},
+			summary: "Remove users from a role",
+			tags: [
+				"Roles"
+			]
+		}
+	},
+	"/api/v1/roles/{roleid}/users/{userId}": {
+		post: {
+			description: "Grants the role to the user as a DIRECT membership. The operation is IDEMPOTENT: granting a role the user already holds returns 200 and changes nothing — no duplicate membership is created and retries are safe, even when the role's editUsers flag has since been turned off. Note the inherited-membership behavior (legacy parity): role membership is inherited DOWN the role tree, so a user holding a parent role implicitly holds every child role. Granting a role the user already INHERITS this way also returns 200 but does NOT create a direct membership — the user will not appear in the role's direct-users list afterwards. Roles whose editUsers flag is false cannot be granted (403); workflow and system roles are non-grantable because that flag is false on them.",
+			operationId: "addUserToRole",
+			parameters: [
+				{
+					description: "Id of the role to grant",
+					"in": "path",
+					name: "roleid",
+					required: true,
+					schema: {
+						type: "string"
+					}
+				},
+				{
+					description: "Id of the user to grant the role to",
+					"in": "path",
+					name: "userId",
+					required: true,
+					schema: {
+						type: "string"
+					}
+				}
+			],
+			responses: {
+				"200": {
+					content: {
+						"application/json": {
+							schema: {
+								$ref: "#/components/schemas/ResponseEntityRoleUserGrantView"
+							}
+						}
+					},
+					description: "User holds the role after the call; the response carries the granted roleId and a minimal user payload"
+				},
+				"401": {
+					content: {
+						"application/json": {
+						}
+					},
+					description: "Unauthorized - authentication required"
+				},
+				"403": {
+					content: {
+						"application/json": {
+						}
+					},
+					description: "Forbidden - admin permissions required, or the role's editUsers flag is false"
+				},
+				"404": {
+					content: {
+						"application/json": {
+						}
+					},
+					description: "Role or user not found"
+				}
+			},
+			summary: "Grant a role to a user",
+			tags: [
+				"Roles"
+			]
 		}
 	},
 	"/api/v1/site": {
@@ -18543,6 +18814,41 @@ var components = {
 				}
 			}
 		},
+		ResponseEntityRoleDeletionView: {
+			type: "object",
+			properties: {
+				entity: {
+					$ref: "#/components/schemas/RoleDeletionView"
+				},
+				errors: {
+					type: "array",
+					items: {
+						$ref: "#/components/schemas/ErrorEntity"
+					}
+				},
+				i18nMessagesMap: {
+					type: "object",
+					additionalProperties: {
+						type: "string"
+					}
+				},
+				messages: {
+					type: "array",
+					items: {
+						$ref: "#/components/schemas/MessageEntity"
+					}
+				},
+				pagination: {
+					$ref: "#/components/schemas/Pagination"
+				},
+				permissions: {
+					type: "array",
+					items: {
+						type: "string"
+					}
+				}
+			}
+		},
 		ResponseEntityRoleDetailView: {
 			type: "object",
 			properties: {
@@ -18616,6 +18922,76 @@ var components = {
 				}
 			}
 		},
+		ResponseEntityRoleUserGrantView: {
+			type: "object",
+			properties: {
+				entity: {
+					$ref: "#/components/schemas/RoleUserGrantView"
+				},
+				errors: {
+					type: "array",
+					items: {
+						$ref: "#/components/schemas/ErrorEntity"
+					}
+				},
+				i18nMessagesMap: {
+					type: "object",
+					additionalProperties: {
+						type: "string"
+					}
+				},
+				messages: {
+					type: "array",
+					items: {
+						$ref: "#/components/schemas/MessageEntity"
+					}
+				},
+				pagination: {
+					$ref: "#/components/schemas/Pagination"
+				},
+				permissions: {
+					type: "array",
+					items: {
+						type: "string"
+					}
+				}
+			}
+		},
+		ResponseEntityRoleUsersRemovalView: {
+			type: "object",
+			properties: {
+				entity: {
+					$ref: "#/components/schemas/RoleUsersRemovalView"
+				},
+				errors: {
+					type: "array",
+					items: {
+						$ref: "#/components/schemas/ErrorEntity"
+					}
+				},
+				i18nMessagesMap: {
+					type: "object",
+					additionalProperties: {
+						type: "string"
+					}
+				},
+				messages: {
+					type: "array",
+					items: {
+						$ref: "#/components/schemas/MessageEntity"
+					}
+				},
+				pagination: {
+					$ref: "#/components/schemas/Pagination"
+				},
+				permissions: {
+					type: "array",
+					items: {
+						type: "string"
+					}
+				}
+			}
+		},
 		ResponseEntityRoleViewListView: {
 			type: "object",
 			properties: {
@@ -19938,6 +20314,32 @@ var components = {
 				}
 			}
 		},
+		RoleDeletionView: {
+			type: "object",
+			properties: {
+				deleted: {
+					type: "boolean",
+					description: "Whether the role was deleted",
+					example: true
+				},
+				roleId: {
+					type: "string",
+					description: "Id of the deleted role",
+					example: "48190c8c-42c4-46af-8d1a-0cd5db894797"
+				},
+				usersAffected: {
+					type: "integer",
+					format: "int32",
+					description: "Number of users the role was removed from by the cascading deletion. Counts direct assignments only; users inheriting the role through the role hierarchy are not included",
+					example: 3
+				}
+			},
+			required: [
+				"deleted",
+				"roleId",
+				"usersAffected"
+			]
+		},
 		RoleForm: {
 			type: "object",
 			properties: {
@@ -19967,6 +20369,32 @@ var components = {
 				"roleName"
 			]
 		},
+		RoleMemberUserView: {
+			type: "object",
+			description: "The user the role was granted to",
+			properties: {
+				email: {
+					type: "string",
+					description: "Email address of the user",
+					example: "user@example.com"
+				},
+				fullName: {
+					type: "string",
+					description: "Full name of the user",
+					example: "Jane Doe"
+				},
+				userId: {
+					type: "string",
+					description: "Id of the user",
+					example: "dotcms.org.2807"
+				}
+			},
+			required: [
+				"email",
+				"fullName",
+				"userId"
+			]
+		},
 		RoleResponseEntityView: {
 			type: "object",
 			properties: {
@@ -20005,6 +20433,74 @@ var components = {
 				}
 			}
 		},
+		RoleUserGrantView: {
+			type: "object",
+			properties: {
+				granted: {
+					type: "boolean",
+					description: "Whether the user holds the role after the call. The grant is idempotent, so this is also true when the user already held the role and nothing changed",
+					example: true
+				},
+				roleId: {
+					type: "string",
+					description: "Id of the granted role",
+					example: "48190c8c-42c4-46af-8d1a-0cd5db894797"
+				},
+				user: {
+					$ref: "#/components/schemas/RoleMemberUserView"
+				}
+			},
+			required: [
+				"granted",
+				"roleId",
+				"user"
+			]
+		},
+		RoleUsersForm: {
+			type: "object",
+			properties: {
+				userIds: {
+					type: "array",
+					description: "Ids of the users to remove from the role",
+					example: [
+						"dotcms.org.2807"
+					],
+					items: {
+						type: "string",
+						description: "Ids of the users to remove from the role",
+						example: "[\"dotcms.org.2807\"]"
+					},
+					uniqueItems: true
+				}
+			},
+			required: [
+				"userIds"
+			]
+		},
+		RoleUsersRemovalView: {
+			type: "object",
+			properties: {
+				removedUserIds: {
+					type: "array",
+					description: "Ids of the users whose direct membership in the role was removed",
+					items: {
+						type: "string",
+						description: "Ids of the users whose direct membership in the role was removed"
+					}
+				},
+				skipped: {
+					type: "array",
+					description: "Users that could not be removed, each with a reason",
+					items: {
+						$ref: "#/components/schemas/SkippedUserView"
+					}
+				}
+			},
+			required: [
+				"removedUserIds",
+				"skipped"
+			]
+		},
 		RoleView: {
 			type: "object",
 			properties: {
@@ -20038,6 +20534,12 @@ var components = {
 				parent: {
 					type: "string"
 				},
+				roleChildren: {
+					type: "array",
+					items: {
+						$ref: "#/components/schemas/RoleView"
+					}
+				},
 				roleKey: {
 					type: "string"
 				},
@@ -20393,6 +20895,31 @@ var components = {
 				}
 			}
 		},
+		SkippedUserView: {
+			type: "object",
+			description: "Users that could not be removed, each with a reason",
+			properties: {
+				reason: {
+					type: "string",
+					description: "Why the user was skipped",
+					"enum": [
+						"not_found",
+						"inherited",
+						"error"
+					],
+					example: "inherited"
+				},
+				userId: {
+					type: "string",
+					description: "Id of the skipped user, as submitted in the request",
+					example: "dotcms.org.2807"
+				}
+			},
+			required: [
+				"reason",
+				"userId"
+			]
+		},
 		SmallRoleView: {
 			type: "object",
 			properties: {

package/spec.esm.js

@@ -4756,6 +4756,65 @@ var paths = {
 		}
 	},
 	"/api/v1/roles/{roleid}": {
+		"delete": {
+			description: "Deletes a role. The deletion CASCADES and is not reversible: the role is removed from all users that have it, all permissions granted to the role are deleted, and its layout (tool-group) assignments are detached. The response reports how many users were affected. Deletion is rejected when the role has child roles or is referenced by a workflow action's Assign To (409), and for system or locked roles (403).",
+			operationId: "deleteRole",
+			parameters: [
+				{
+					description: "Id of the role to delete",
+					"in": "path",
+					name: "roleid",
+					required: true,
+					schema: {
+						type: "string"
+					}
+				}
+			],
+			responses: {
+				"200": {
+					content: {
+						"application/json": {
+							schema: {
+								$ref: "#/components/schemas/ResponseEntityRoleDeletionView"
+							}
+						}
+					},
+					description: "Role deleted successfully; usersAffected reports the cascade blast radius"
+				},
+				"401": {
+					content: {
+						"application/json": {
+						}
+					},
+					description: "Unauthorized - authentication required"
+				},
+				"403": {
+					content: {
+						"application/json": {
+						}
+					},
+					description: "Forbidden - admin permissions required, or the role is a system or locked role"
+				},
+				"404": {
+					content: {
+						"application/json": {
+						}
+					},
+					description: "Role not found"
+				},
+				"409": {
+					content: {
+						"application/json": {
+						}
+					},
+					description: "Conflict - the role has child roles, or a workflow action references it"
+				}
+			},
+			summary: "Delete a role",
+			tags: [
+				"Roles"
+			]
+		},
 		get: {
 			description: "Load role based on the role id with optional children roles",
 			operationId: "loadRoleByRoleId",
@@ -4823,6 +4882,218 @@ var paths = {
 			tags: [
 				"Roles"
 			]
+		},
+		put: {
+			description: "Updates an existing role's name, key, description, can-grant flags and parent. PUT is a full replace: every field of the role is overwritten from the request body, so clients must send the complete role representation — omitted fields are reset (booleans default to false, omitted roleKey/description are cleared, omitted parentRoleId reparents to root). A null parentRoleId turns the role into a root role. Reparenting under the role's own descendant is rejected. System and locked roles cannot be updated. Note: the role is updated in place — grants and permissions attached to the role are preserved.",
+			operationId: "updateRole",
+			parameters: [
+				{
+					description: "Id of the role to update",
+					"in": "path",
+					name: "roleid",
+					required: true,
+					schema: {
+						type: "string"
+					}
+				}
+			],
+			requestBody: {
+				content: {
+					"application/json": {
+						schema: {
+							$ref: "#/components/schemas/RoleForm"
+						}
+					}
+				},
+				description: "Role information — same shape as POST /v1/roles",
+				required: true
+			},
+			responses: {
+				"200": {
+					content: {
+						"application/json": {
+							schema: {
+								$ref: "#/components/schemas/ResponseEntityRoleDetailView"
+							}
+						}
+					},
+					description: "Role updated successfully"
+				},
+				"400": {
+					content: {
+						"application/json": {
+						}
+					},
+					description: "Bad request - invalid role name, or the reparent would create a hierarchy cycle"
+				},
+				"401": {
+					content: {
+						"application/json": {
+						}
+					},
+					description: "Unauthorized - authentication required"
+				},
+				"403": {
+					content: {
+						"application/json": {
+						}
+					},
+					description: "Forbidden - admin permissions required, or the role is a system or locked role"
+				},
+				"404": {
+					content: {
+						"application/json": {
+						}
+					},
+					description: "Role or parent role not found"
+				},
+				"409": {
+					content: {
+						"application/json": {
+						}
+					},
+					description: "Conflict - duplicate role key, or duplicate role name under the same parent"
+				}
+			},
+			summary: "Update a role",
+			tags: [
+				"Roles"
+			]
+		}
+	},
+	"/api/v1/roles/{roleid}/users": {
+		"delete": {
+			description: "Bulk-removes the DIRECT membership of the given users from the role. The batch has PARTIAL-SUCCESS semantics: it never fails as a whole once the role resolves — every removable membership is removed and every other entry is reported in the skipped list with a reason: not_found (no user matches the id), inherited (the user is not a direct member — the membership is inherited through the role hierarchy, or the user is not a member at all; inherited membership can only be revoked by removing the user from the ancestor role that grants it), or error (unexpected per-user failure, logged server-side). Removals are committed per user, so entries already processed stay removed regardless of later entries.",
+			operationId: "removeUsersFromRole",
+			parameters: [
+				{
+					description: "Id of the role to remove users from",
+					"in": "path",
+					name: "roleid",
+					required: true,
+					schema: {
+						type: "string"
+					}
+				}
+			],
+			requestBody: {
+				content: {
+					"application/json": {
+						schema: {
+							$ref: "#/components/schemas/RoleUsersForm"
+						}
+					}
+				},
+				description: "Ids of the users to remove from the role",
+				required: true
+			},
+			responses: {
+				"200": {
+					content: {
+						"application/json": {
+							schema: {
+								$ref: "#/components/schemas/ResponseEntityRoleUsersRemovalView"
+							}
+						}
+					},
+					description: "Batch processed; removedUserIds and skipped report the per-user outcomes"
+				},
+				"400": {
+					content: {
+						"application/json": {
+						}
+					},
+					description: "Bad request - missing body, empty userIds, or null/blank entries"
+				},
+				"401": {
+					content: {
+						"application/json": {
+						}
+					},
+					description: "Unauthorized - authentication required"
+				},
+				"403": {
+					content: {
+						"application/json": {
+						}
+					},
+					description: "Forbidden - admin permissions required"
+				},
+				"404": {
+					content: {
+						"application/json": {
+						}
+					},
+					description: "Role not found"
+				}
+			},
+			summary: "Remove users from a role",
+			tags: [
+				"Roles"
+			]
+		}
+	},
+	"/api/v1/roles/{roleid}/users/{userId}": {
+		post: {
+			description: "Grants the role to the user as a DIRECT membership. The operation is IDEMPOTENT: granting a role the user already holds returns 200 and changes nothing — no duplicate membership is created and retries are safe, even when the role's editUsers flag has since been turned off. Note the inherited-membership behavior (legacy parity): role membership is inherited DOWN the role tree, so a user holding a parent role implicitly holds every child role. Granting a role the user already INHERITS this way also returns 200 but does NOT create a direct membership — the user will not appear in the role's direct-users list afterwards. Roles whose editUsers flag is false cannot be granted (403); workflow and system roles are non-grantable because that flag is false on them.",
+			operationId: "addUserToRole",
+			parameters: [
+				{
+					description: "Id of the role to grant",
+					"in": "path",
+					name: "roleid",
+					required: true,
+					schema: {
+						type: "string"
+					}
+				},
+				{
+					description: "Id of the user to grant the role to",
+					"in": "path",
+					name: "userId",
+					required: true,
+					schema: {
+						type: "string"
+					}
+				}
+			],
+			responses: {
+				"200": {
+					content: {
+						"application/json": {
+							schema: {
+								$ref: "#/components/schemas/ResponseEntityRoleUserGrantView"
+							}
+						}
+					},
+					description: "User holds the role after the call; the response carries the granted roleId and a minimal user payload"
+				},
+				"401": {
+					content: {
+						"application/json": {
+						}
+					},
+					description: "Unauthorized - authentication required"
+				},
+				"403": {
+					content: {
+						"application/json": {
+						}
+					},
+					description: "Forbidden - admin permissions required, or the role's editUsers flag is false"
+				},
+				"404": {
+					content: {
+						"application/json": {
+						}
+					},
+					description: "Role or user not found"
+				}
+			},
+			summary: "Grant a role to a user",
+			tags: [
+				"Roles"
+			]
 		}
 	},
 	"/api/v1/site": {
@@ -18541,6 +18812,41 @@ var components = {
 				}
 			}
 		},
+		ResponseEntityRoleDeletionView: {
+			type: "object",
+			properties: {
+				entity: {
+					$ref: "#/components/schemas/RoleDeletionView"
+				},
+				errors: {
+					type: "array",
+					items: {
+						$ref: "#/components/schemas/ErrorEntity"
+					}
+				},
+				i18nMessagesMap: {
+					type: "object",
+					additionalProperties: {
+						type: "string"
+					}
+				},
+				messages: {
+					type: "array",
+					items: {
+						$ref: "#/components/schemas/MessageEntity"
+					}
+				},
+				pagination: {
+					$ref: "#/components/schemas/Pagination"
+				},
+				permissions: {
+					type: "array",
+					items: {
+						type: "string"
+					}
+				}
+			}
+		},
 		ResponseEntityRoleDetailView: {
 			type: "object",
 			properties: {
@@ -18614,6 +18920,76 @@ var components = {
 				}
 			}
 		},
+		ResponseEntityRoleUserGrantView: {
+			type: "object",
+			properties: {
+				entity: {
+					$ref: "#/components/schemas/RoleUserGrantView"
+				},
+				errors: {
+					type: "array",
+					items: {
+						$ref: "#/components/schemas/ErrorEntity"
+					}
+				},
+				i18nMessagesMap: {
+					type: "object",
+					additionalProperties: {
+						type: "string"
+					}
+				},
+				messages: {
+					type: "array",
+					items: {
+						$ref: "#/components/schemas/MessageEntity"
+					}
+				},
+				pagination: {
+					$ref: "#/components/schemas/Pagination"
+				},
+				permissions: {
+					type: "array",
+					items: {
+						type: "string"
+					}
+				}
+			}
+		},
+		ResponseEntityRoleUsersRemovalView: {
+			type: "object",
+			properties: {
+				entity: {
+					$ref: "#/components/schemas/RoleUsersRemovalView"
+				},
+				errors: {
+					type: "array",
+					items: {
+						$ref: "#/components/schemas/ErrorEntity"
+					}
+				},
+				i18nMessagesMap: {
+					type: "object",
+					additionalProperties: {
+						type: "string"
+					}
+				},
+				messages: {
+					type: "array",
+					items: {
+						$ref: "#/components/schemas/MessageEntity"
+					}
+				},
+				pagination: {
+					$ref: "#/components/schemas/Pagination"
+				},
+				permissions: {
+					type: "array",
+					items: {
+						type: "string"
+					}
+				}
+			}
+		},
 		ResponseEntityRoleViewListView: {
 			type: "object",
 			properties: {
@@ -19936,6 +20312,32 @@ var components = {
 				}
 			}
 		},
+		RoleDeletionView: {
+			type: "object",
+			properties: {
+				deleted: {
+					type: "boolean",
+					description: "Whether the role was deleted",
+					example: true
+				},
+				roleId: {
+					type: "string",
+					description: "Id of the deleted role",
+					example: "48190c8c-42c4-46af-8d1a-0cd5db894797"
+				},
+				usersAffected: {
+					type: "integer",
+					format: "int32",
+					description: "Number of users the role was removed from by the cascading deletion. Counts direct assignments only; users inheriting the role through the role hierarchy are not included",
+					example: 3
+				}
+			},
+			required: [
+				"deleted",
+				"roleId",
+				"usersAffected"
+			]
+		},
 		RoleForm: {
 			type: "object",
 			properties: {
@@ -19965,6 +20367,32 @@ var components = {
 				"roleName"
 			]
 		},
+		RoleMemberUserView: {
+			type: "object",
+			description: "The user the role was granted to",
+			properties: {
+				email: {
+					type: "string",
+					description: "Email address of the user",
+					example: "user@example.com"
+				},
+				fullName: {
+					type: "string",
+					description: "Full name of the user",
+					example: "Jane Doe"
+				},
+				userId: {
+					type: "string",
+					description: "Id of the user",
+					example: "dotcms.org.2807"
+				}
+			},
+			required: [
+				"email",
+				"fullName",
+				"userId"
+			]
+		},
 		RoleResponseEntityView: {
 			type: "object",
 			properties: {
@@ -20003,6 +20431,74 @@ var components = {
 				}
 			}
 		},
+		RoleUserGrantView: {
+			type: "object",
+			properties: {
+				granted: {
+					type: "boolean",
+					description: "Whether the user holds the role after the call. The grant is idempotent, so this is also true when the user already held the role and nothing changed",
+					example: true
+				},
+				roleId: {
+					type: "string",
+					description: "Id of the granted role",
+					example: "48190c8c-42c4-46af-8d1a-0cd5db894797"
+				},
+				user: {
+					$ref: "#/components/schemas/RoleMemberUserView"
+				}
+			},
+			required: [
+				"granted",
+				"roleId",
+				"user"
+			]
+		},
+		RoleUsersForm: {
+			type: "object",
+			properties: {
+				userIds: {
+					type: "array",
+					description: "Ids of the users to remove from the role",
+					example: [
+						"dotcms.org.2807"
+					],
+					items: {
+						type: "string",
+						description: "Ids of the users to remove from the role",
+						example: "[\"dotcms.org.2807\"]"
+					},
+					uniqueItems: true
+				}
+			},
+			required: [
+				"userIds"
+			]
+		},
+		RoleUsersRemovalView: {
+			type: "object",
+			properties: {
+				removedUserIds: {
+					type: "array",
+					description: "Ids of the users whose direct membership in the role was removed",
+					items: {
+						type: "string",
+						description: "Ids of the users whose direct membership in the role was removed"
+					}
+				},
+				skipped: {
+					type: "array",
+					description: "Users that could not be removed, each with a reason",
+					items: {
+						$ref: "#/components/schemas/SkippedUserView"
+					}
+				}
+			},
+			required: [
+				"removedUserIds",
+				"skipped"
+			]
+		},
 		RoleView: {
 			type: "object",
 			properties: {
@@ -20036,6 +20532,12 @@ var components = {
 				parent: {
 					type: "string"
 				},
+				roleChildren: {
+					type: "array",
+					items: {
+						$ref: "#/components/schemas/RoleView"
+					}
+				},
 				roleKey: {
 					type: "string"
 				},
@@ -20391,6 +20893,31 @@ var components = {
 				}
 			}
 		},
+		SkippedUserView: {
+			type: "object",
+			description: "Users that could not be removed, each with a reason",
+			properties: {
+				reason: {
+					type: "string",
+					description: "Why the user was skipped",
+					"enum": [
+						"not_found",
+						"inherited",
+						"error"
+					],
+					example: "inherited"
+				},
+				userId: {
+					type: "string",
+					description: "Id of the skipped user, as submitted in the request",
+					example: "dotcms.org.2807"
+				}
+			},
+			required: [
+				"reason",
+				"userId"
+			]
+		},
 		SmallRoleView: {
 			type: "object",
 			properties: {