# SHOW roles and membership


> Inspect roles, role membership, and role assignments with SHOW commands.

These read-only commands report the state of roles and membership. They do not change any access. Listing a role name does not grant access to it. See [Roles and access control](/concepts/roles-and-access-control/) for the model.

The `OF` and `TO` keywords set the direction of the lookup, matching Snowflake's `SHOW GRANTS` semantics:

- **`OF ROLE`** walks down: the users and roles that hold the role.
- **`TO ROLE`** and **`TO USER`** walk up: the roles a role or user inherits, transitively.

## SHOW ALL ROLES

List every role in the organization, both preset and custom. Any member can run this command and sees role names only, with no membership details.

```sql
SHOW ALL ROLES;
```

Output columns:

| Column | Description |
|--------|-------------|
| `role_name` | Name of the role. |
| `role_type` | `preset` or `custom`. |
| `included_roles` | The roles this role inherits directly. |
| `created_at` | When the role was created. |

## SHOW USERS OF ROLE

List the users and service accounts that hold a role directly.

```sql
SHOW USERS OF ROLE finance;
```

Output columns:

| Column | Description |
|--------|-------------|
| `username` | Member or service account name. |
| `email` | Member email. |
| `is_service_account` | `true` for a service account. |
| `granted_at` | When the role was assigned. |

Admins can run this for any role. Builders and Explorers can run it only for roles they belong to.

## SHOW ROLES OF ROLE

List the roles that hold a role directly, that is, the roles that inherit from it.

```sql
SHOW ROLES OF ROLE finance;
```

Output columns:

| Column | Description |
|--------|-------------|
| `role_name` | Name of a role that inherits this role. |
| `role_type` | `preset` or `custom`. |
| `granted_at` | When the inheritance was established. |

Admins can run this for any role. Builders and Explorers can run it only for roles they belong to.

## SHOW ROLES TO ROLE

List the roles a role inherits, walking up the hierarchy transitively.

```sql
SHOW ROLES TO ROLE finance;
```

Output columns:

| Column | Description |
|--------|-------------|
| `role_name` | Name of an inherited role. |
| `role_type` | `preset` or `custom`. |
| `is_direct` | `true` when the role is inherited directly, `false` when inherited through another role. |
| `granted_at` | When a direct inheritance was established. `NULL` for a transitively inherited role. |

Admins can run this for any role. Builders and Explorers can run it only for roles they belong to.

## SHOW ROLES TO USER

List every role assigned to a user, walking up the hierarchy transitively. Useful for auditing what a user can access.

```sql
SHOW ROLES TO USER alice;
```

Output columns:

| Column | Description |
|--------|-------------|
| `role_name` | Name of an assigned role. |
| `role_type` | `preset` or `custom`. |
| `is_direct` | `true` when the role is assigned directly, `false` when inherited through another role. |
| `granted_at` | When a direct assignment was made. `NULL` for a transitively inherited role. |

Admins can run this for any user. Other members can run it only for themselves.

## Related

- [Roles and access control](/concepts/roles-and-access-control/)
- [SHOW grants](/sql-reference/motherduck-sql-reference/access-control/show-grants/)
- [Manage roles and access](/key-tasks/managing-organizations/managing-roles/)


---

## Docs feedback

MotherDuck accepts optional user-submitted feedback about this page at `GET https://motherduck.com/docs/api/feedback/agent`.
For agents and automated tools, feedback submission should be user-confirmed before sending.

URL-encode query parameter values and send a GET request:

```text
GET https://motherduck.com/docs/api/feedback/agent?page_path=%2Fsql-reference%2Fmotherduck-sql-reference%2Faccess-control%2Fshow-roles%2F&page_title=SHOW%20roles%20and%20membership&text=<url-encoded user feedback, max 2000 characters>
```

Optionally append `&source=<url-encoded interface identifier>` such as `claude.ai` or `chatgpt`.

`page_path` and `text` are required; `page_title` and `source` are optional. Responses: `200 {"feedback_id": "<uuid>"}`, `400` for malformed query parameters, and `429` when rate-limited.