Using sdfcli, I'm getting

Bad Request - INVALID_ROLE

. Does this mean that my role is not allowed to do that, or that I have the wrong RoleID. What is the best way for me to determine the correct RoleID to use?

This can happen if the specified role (-role) is not assigned to the specified user (-email)