> ## Documentation Index > Fetch the complete documentation index at: https://www.truefoundry.com/llms.txt > Use this file to discover all available pages before exploring further. # Generate role-binding manifests for a resource or subject > Generate role-binding manifests equivalent to AUTH_API grants. Provide resourceType+resourceId or subjectType+subjectId (same subject types as list grants). Set includeOnlyTenantRoles=true for a user or team to keep only tenant grants. One manifest is returned per role. ## OpenAPI ````yaml /openapi.json get /api/svc/v1/role-bindings/generate-manifest openapi: 3.1.0 info: title: TrueFoundry API description: API for TrueFoundry version: 0.1.0 contact: {} servers: - url: https://{controlPlaneURL} variables: controlPlaneURL: default: app.truefoundry.com description: Control Plane URL security: [] tags: - name: Agent - name: Agent Skills - name: Applications - name: Metrics - name: Apply - name: Artifacts - name: Audit Logs - name: Clusters - name: Jobs - name: LLM Gateway Budgets - name: Logs - name: MCP Registry - name: MCP Servers V2 - name: MLRepos - name: Model Deployments - name: Models - name: Personal Access Tokens - name: Prompts - name: Provider Integrations - name: SCIM v2 - name: Secret Groups - name: Secrets - name: Teams - name: Traces - name: Users - name: Virtual Accounts - name: Role Bindings - name: Workspaces - name: Provider Accounts paths: /api/svc/v1/role-bindings/generate-manifest: get: tags: - Role Bindings - public summary: Generate role-binding manifests for a resource or subject description: >- Generate role-binding manifests equivalent to AUTH_API grants. Provide resourceType+resourceId or subjectType+subjectId (same subject types as list grants). Set includeOnlyTenantRoles=true for a user or team to keep only tenant grants. One manifest is returned per role. operationId: RoleBinding.getManifestsForResourceOrSubject parameters: - name: resourceType required: false in: query description: >- By-resource mode: use with resourceId (XOR subjectType+subjectId). Only resource types that role-binding names support. schema: example: workspace type: string enum: - cluster - workspace - secret-group - tenant - mlf-project - repository - provider-integration - provider-account - tracing-project - agent - agent-app - mcp-server - name: resourceId required: false in: query description: >- By-resource mode: system-generated unique identifier for the resource. schema: example: hoqc0a1ryvmwf5f0ka0zdymf type: string - name: subjectType required: false in: query description: >- By-subject mode: use with subjectId. Same subject types as list grants (`user`, `team`, `agent`, `virtualaccount`). schema: example: user type: string enum: - user - team - agent - virtualaccount - name: subjectId required: false in: query description: 'By-subject mode: system-generated unique identifier for the subject.' schema: example: z9rcvwtau3g0m4o5kjoarlt0 type: string - name: includeOnlyTenantRoles required: false in: query description: >- When true and the subject is a user or team, keep only grants on the tenant resource. Ignored for other subject types and for resource mode. Default false. schema: example: true type: boolean responses: '200': description: Role-binding manifests, one per role. content: application/json: schema: $ref: '#/components/schemas/ExportRoleBindingManifestsResponse' security: - jwt: [] components: schemas: ExportRoleBindingManifestsResponse: type: object properties: data: description: >- Role-binding manifests equivalent to AUTH_API grants on the resource or subject, one per role. type: array items: oneOf: - $ref: '#/components/schemas/RoleBindingManifest' required: - data title: ExportRoleBindingManifestsResponse x-fern-type-name: ExportRoleBindingManifestsResponse RoleBindingManifest: type: object required: - type - name - subjects - permissions properties: type: description: +value=role-binding type: string enum: - role-binding default: role-binding name: description: Unique name for this role binding. type: string pattern: ^[a-z][a-z0-9-]{1,64}[a-z0-9]$ subjects: description: >- One row per principal; set type and name (email, team name, virtual account name, agent name, or external identity name). type: array items: $ref: '#/components/schemas/RoleBindingSubject' permissions: description: Resource-scoped role grants (resource type, FQN, and role name). type: array items: $ref: '#/components/schemas/RoleBindingPermission' title: RoleBindingManifest x-fern-type-name: RoleBindingManifest RoleBindingSubject: description: >- Single row per principal: type selects how to interpret name (email vs names). Field names mirror the manifest root (type + name) for consistency in the UI and YAML. type: object required: - type - name properties: type: description: >- Whether this row identifies a user (email), a team (name), a virtual account (name), or an agent (name). type: string enum: - user - team - virtualaccount - agent name: description: >- User email when type is user; team, virtual account, or agent name otherwise. type: string minLength: 1 maxLength: 1024 title: RoleBindingSubject x-fern-type-name: RoleBindingSubject RoleBindingPermission: description: Grants a named account role on a specific resource identified by FQN. type: object required: - resourceType - resourceFqn - role properties: resourceType: description: Target resource kind (e.g. workspace, cluster, ml-repo). type: string minLength: 1 maxLength: 128 resourceFqn: description: Fully qualified name of the resource. type: string minLength: 1 maxLength: 1024 role: description: Name of the role to bind (e.g. workspace-editor, model-user). type: string minLength: 1 maxLength: 255 title: RoleBindingPermission x-fern-type-name: RoleBindingPermission securitySchemes: jwt: type: http scheme: bearer bearerFormat: JWT ````