Organization Members, Roles, and Role Assignments

Three read endpoints for an organization's access configuration are now available on V4:

• GET /members lists the members of the organization tied to the API credentials, with each member's id, user_id, email, first_name, last_name, and status (ACTIVE, ARCHIVED, or PENDING). Identity only; it does not return role assignments.
• GET /roles lists every role defined in the organization with its name, optional description, an is_system_role flag distinguishing built-in roles from org-authored ones, and the flat set of permission keys it grants. Each permission is an opaque, colon-delimited string; do not rely on its internal structure.
• GET /role-assignments lists which member is assigned which role and the scope of that assignment: ORGANIZATION for the whole organization, or SUBSIDIARY for a single subsidiary. Accepts an optional member_id filter.

Members and roles are referenced by id, so join GET /role-assignments against GET /members and GET /roles to resolve names. All three endpoints are paginated via limit and cursor.