roles form and api