@James Thanks, we are wanting to make an API call on behalf of a user (using a token linked to an API developer key) from an LTI tool.
Our LTI is from launched from the Settings part of a course, but it appears that ENV.ALL_ROLES isn't defined on that page otherwise we could use a bit of custom JS in the theme and window.postMessage() to pass the data across. But thanks for the idea it's really close to working.
We were trying to avoid having an admin token and a server side component that caches the roles as it complicates our setup allow, but maybe that's the way to go 🙁
Hardcoding roles won't fully work as we have some sub-accounts that have custom roles defined in them that aren't defined in other sub-accounts.