# Use of roles/permissions without using custom APIs **URL:** \ **Category:** Get Help\ **Created:** [June 22, 2021, 8:03pm UTC](https://community.auth0.com/t/use-of-roles-permissions-without-using-custom-apis/64882 "2021-06-22T20:03:59Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![kunalbhai.shah](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/kunalbhai.shah/32/16125_2.png) [@kunalbhai.shah](https://community.auth0.com/u/kunalbhai.shah)\ **Post date:** [June 22, 2021, 8:03pm UTC](https://community.auth0.com/t/use-of-roles-permissions-without-using-custom-apis/64882/1 "2021-06-22T20:03:59Z")
General question about authorization support. Is it possible to use roles and permissions without having any custom APIs? Currently what I see is roles are allowed to be created and associated to a user, but for permissions you must have APIs. Can we create generic permissions for roles to be used with our application without defining our APIs in Auth0? So our goal is to just use roles/permissions store from Auth0 and actual authorization will be done in our app. If anyone know this is possible… ---
**Author:** ![markd](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/markd/32/38919_2.png) [@markd](https://community.auth0.com/u/markd)\ **Post date:** [June 22, 2021, 8:57pm UTC](https://community.auth0.com/t/use-of-roles-permissions-without-using-custom-apis/64882/2 "2021-06-22T20:57:40Z")
Hello @kunalbhai.shah, Welcome to the Community! Auth0 provides a lot of flexibility on this front. You could use the built-in Roles feature and just send that data to your own apps / APIs in the user’s tokens, or build something of your own by storing role related data in the user’s `app_metadata` and again, put that data into the user’s tokens for consumption by your apps & APIs. ---
**Author:** ![kunalbhai.shah](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/kunalbhai.shah/32/16125_2.png) [@kunalbhai.shah](https://community.auth0.com/u/kunalbhai.shah)\ **Post date:** [June 22, 2021, 9:06pm UTC](https://community.auth0.com/t/use-of-roles-permissions-without-using-custom-apis/64882/3 "2021-06-22T21:06:58Z")
Thanks @markd … we were able to do that and update identity token to include user roles… but not able to add permissions… so was just wondering if this is possible… ---
**Author:** ![kunalbhai.shah](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/kunalbhai.shah/32/16125_2.png) [@kunalbhai.shah](https://community.auth0.com/u/kunalbhai.shah)\ **Post date:** [June 24, 2021, 2:53pm UTC](https://community.auth0.com/t/use-of-roles-permissions-without-using-custom-apis/64882/4 "2021-06-24T14:53:34Z")
Hi @markd, may be related question… Just found out that roles we add via Users-\> Roles tab is part of Authorization Core while what shows up in app\_metadata is part of Auth Extensions and they are different… We saw this as our roles are not matching between what’s in app\_metadata vs what’s in Roles tab. So question is how we can get to our roles in Authorization Core so that we can add them to our token? ---
**Author:** ![konrad.sopala](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/konrad.sopala/32/13516_2.png) [@konrad.sopala](https://community.auth0.com/u/konrad.sopala)\ **Post date:** [July 1, 2021, 12:06pm UTC](https://community.auth0.com/t/use-of-roles-permissions-without-using-custom-apis/64882/7 "2021-07-01T12:06:40Z")
Previous message deleted due to SPAM reasons. ---
**Author:** ![markd](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/markd/32/38919_2.png) [@markd](https://community.auth0.com/u/markd)\ **Post date:** [July 26, 2021, 1:37pm UTC](https://community.auth0.com/t/use-of-roles-permissions-without-using-custom-apis/64882/8 "2021-07-26T13:37:28Z")
Just my opinion here but I would disable the authz extension altogether, and remove the `app_metadata.authorization` object from all your users to avoid confusion. I’m not using authz core yet but you should be able to call the API from a [Rule](https://manage.empire-prod.auth0.com/docs/rules) (or an [Action](https://manage.empire-prod.auth0.com/docs/actions)) to get a users roles and scopes. In fact, it looks like the authz core data should be available in the context. Have a look at: > **[Sample Use Cases: Rules with Authorization](https://manage.empire-prod.auth0.com/docs/manage-users/access-control/sample-use-cases-rules-with-authorization)** > > Learn how to use rules with roles-based access control (RBAC). For use with our Authorization Core feature set. and: > **[Login Flow](https://manage.empire-prod.auth0.com/docs/customize/actions/flows-and-triggers/login-flow)** > > Learn about the Actions Login Flow and the post-login Action trigger, which is executed after a user logs in and when a Refresh Token is requested. ---
**Author:** ![konrad.sopala](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/konrad.sopala/32/13516_2.png) [@konrad.sopala](https://community.auth0.com/u/konrad.sopala)\ **Post date:** [July 29, 2021, 8:22am UTC](https://community.auth0.com/t/use-of-roles-permissions-without-using-custom-apis/64882/9 "2021-07-29T08:22:56Z")
Thanks for sharing that Mark! ---
**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\ **Post date:** [August 13, 2021, 8:23am UTC](https://community.auth0.com/t/use-of-roles-permissions-without-using-custom-apis/64882/10 "2021-08-13T08:23:18Z")
This topic was automatically closed 15 days after the last reply. New replies are no longer allowed.