Role fields from export cannot be imported

[thecjharries]

Checklist

• I have looked into the README and have not found a suitable solution or answer.
• I have looked into the documentation and have not found a suitable solution or answer.
• I have searched the issues and have not found a suitable solution or answer.
• I have upgraded to the latest version of this tool and the issue still persists.
• I have searched the Auth0 Community forums and have not found a suitable solution or answer.
• I agree to the terms within the Auth0 Code of Conduct.

Description

Tenants roles cannot be exported then imported using YAML. The docs show patching roles does not take type as an input so the error makes sense. The docs show getting roles includes this field (as does the return from a patch).

Expectation

Tenant roles should be able to be exported then imported using YAML..

Either the role type is important information that should be in the tenant output but ignored during the role update or it's extraneous info that doesn't need to be in the tenant output.

Reproduction

1. Create a tenant role.
2. Run an export with the YAML format. Your export will contain something like this; note the type field.

   roles:
     - name: Some role
       description: Does something
       permissions:
         - permission_name: some:perm
           resource_server_identifier: https://example.com/
       type: tenant

3. Run an import using the output from 2.

   2026-07-28T16:26:07.784Z - error: Problem running command import during stage processChanges when processing type roles
   BadRequestError: BadRequestError
   Status code: 400
   Body: {
     "statusCode": 400,
     "error": "Bad Request",
     "message": "Payload validation error: 'Additional properties not allowed: type'.",
     "errorCode": "invalid_body"
   }

Deploy CLI version

8.41.0

Node version

v22.22.0

[harshithRai]

Thank you for reporting this @thecjharries!
We will start investigating this and be back with an approach to proceed further.

[harshithRai]

Thanks for the detailed repro, @thecjharries. Confirmed and traced the cause - the type field is returned on export but rejected by the roles write endpoint, which breaks the round-trip.

There's a release scheduled very soon that I don't want to disturb, so I'll raise the PR for this fix after it goes out to allow for enough time for internal testing and regression analysis. Will link the PR here once it's up.