malexmave · Apr 22, 2026
@@ -27,6 +27,12 @@ When a user wants to authenticate with Passkeys, {project_name} shows the authen
 As part of this change, the passkey authentication page in the login theme and the signing-in page in the account console were updated.
 If you use a custom theme that overrides these pages, verify that your customizations work as expected with this release.
 
+== Dedicated admin role for realm exports
+
+{project_name} now provides a dedicated realm admin role for exporting realms: `export-realm`.
+
+Previously, exporting a realm via the Admin API's partial export endpoint required the `manage-realm` role, which grants broad administrative access. The new `export-realm` role allows administrators to perform realm exports without requiring full realm management privileges. It allows exporting group and client information as well, without requiring the `query-groups` or `view-clients` role.
+
 == Realm search now matches by display name
 
 When searching for realms in the admin console, the search now also matches against the realm's display name in addition to the realm name.

@@ -30,27 +30,28 @@ level of access to manage an individual realm.
 
 The roles available are:
 
-* create-client
-* impersonation
-* manage-authorization
-* manage-clients
-* manage-events
-* manage-identity-providers
-* manage-organizations
-* manage-realm
-* manage-users
-* query-clients
-* query-groups
-* query-organizations
-* query-realms
-* query-users
-* view-authorization
-* view-clients
-* view-events
-* view-identity-providers
-* view-organizations
-* view-realm
-* view-users
+* **create-client**: Allows creating new clients in the realm.
+* **export-realm**: Allows exporting the realm configuration, including clients, groups and roles (but no secrets).
+* **impersonation**: Allows impersonating other users for testing and support purposes.
+* **manage-authorization**: Allows creating, modifying, and deleting authorization policies and resource-based access controls.
+* **manage-clients**: Allows full management of all clients, including creation, configuration, and deletion.
+* **manage-events**: Allows configuring event listeners, enabling or disabling event logging, and clearing event logs.
+* **manage-identity-providers**: Allows creating, configuring, and deleting identity providers and federation settings.
+* **manage-organizations**: Allows creating, configuring, and managing organizations.
+* **manage-realm**: Allows full management of realm settings and configuration. Implies `view-realm`.
+* **manage-users**: Allows full management of users, including creation, modification, deletion, and role assignment.
+* **query-clients**: Allows querying and listing clients without granting view or modification access.
+* **query-groups**: Allows querying and listing groups without granting view or modification access.
+* **query-organizations**: Allows querying and listing organizations without granting view or modification access.
+* **query-realms**: Allows querying and listing available realms.
+* **query-users**: Allows querying and listing users without granting view or modification access.
+* **view-authorization**: Allows viewing authorization policies and resource configurations.
+* **view-clients**: Allows viewing client details and configurations (incl. client secrets) without modification access.
+* **view-events**: Allows viewing event logs and event configuration without modification access.
+* **view-identity-providers**: Allows viewing identity provider configurations without modification access.
+* **view-organizations**: Allows viewing organization configurations without modification access.
+* **view-realm**: Allows viewing realm settings and general realm information.
+* **view-users**: Allows viewing user details without modification access.
 
 Assign the roles you want to your users and they will only be able to use that specific part of the administration console.
 

@@ -9,6 +9,7 @@ Each realm has a built-in client called `realm-management`.  You can view this c
 `Clients` left menu item of your realm.  This client defines client-level roles that specify permissions that can be granted to manage the realm.
 
 * create-client
+* export-realm
 * impersonation
 * manage-authorization
 * manage-clients

@@ -4103,6 +4103,7 @@ role_query-realms=Query realms
 role_query-clients=Query clients
 role_query-groups=Query groups
 role_query-users=Query users
+role_export-realm=Export realm using the partialExport function
 role_query-organizations=Query organizations
 role_default-roles=Default roles
 role_impersonation=Impersonation

@@ -99,6 +99,7 @@ export const PageNav = () => {
     "view-realm",
     "query-clients",
     "view-identity-providers",
+    "export-realm",
   );
 
   const showWorkflows =