List a workspace's roles with their per-feature grants

Authenticate every request with Authorization: Bearer <token> — a JWT or API token.