List the caller's accessible entities (discovery)

GET /rbac/entities

Returns every entity the authenticated RBAC user can act in, as public identifiers. Unlike most RBAC routes this does not require an entity selection (X-VALR-Entity-Id is not read) — it is the pre-entity discovery call a client uses to populate the entity picker, including after a page reload.

No permission gate beyond being an authenticated RBAC user. The full secure-by-default global rule set still applies (e.g. the user must have completed MFA setup), so clients call this after /authenticate and any device/MFA onboarding it signals — not before.

List the caller's accessible entities (discovery)

/rbac/entities

Responses​

Responses