Hello,
We have enabled a column in the User Custom Fields table configured on the Workspace to store a subrole. Applications can then key off of this value for additional levels of access.
We currently have to manually keep this column up-to-date. It would really help save admin time if there could be an API which could allow to read and update fields in the user custom fields table.
Thanks
Hello again John 
As part of LTS13, we are releasing new functionality called “User Groups” which sounds a lot like your “subrole” concept. It would be available as part of our SAML mapping tool as well, so you could map it from your IDP, and potentially avoid an API entirely.
Would you be willing to do a 30 min call to share more about this “subrole” idea? I will be able to tell you if this will be covered in LTS13.
Marking as “Complete”. This functionality will role out with r284 and LTS13.