diff --git a/frontend/src/api/organizations.js b/frontend/src/api/organizations.js
index ec01073b..63aa0a56 100644
--- a/frontend/src/api/organizations.js
+++ b/frontend/src/api/organizations.js
@@ -12,5 +12,11 @@ export const organizationsApi = {
   },
   listRoles() {
     return request.get('/roles')
+  },
+  listPermissions() {
+    return request.get('/permissions')
+  },
+  updateRole(id, data) {
+    return request.put(`/roles/${id}`, data)
   }
 }
diff --git a/frontend/src/api/organizations.test.js b/frontend/src/api/organizations.test.js
new file mode 100644
index 00000000..4c71a121
--- /dev/null
+++ b/frontend/src/api/organizations.test.js
@@ -0,0 +1,34 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { organizationsApi } from './organizations'
+
+const request = vi.hoisted(() => ({
+  get: vi.fn(),
+  put: vi.fn()
+}))
+
+vi.mock('./index', () => ({ default: request }))
+
+describe('organizations API role permissions', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+  })
+
+  it('loads the permission catalog from the permissions endpoint', async () => {
+    request.get.mockResolvedValue({ data: [{ code: 'inventory.read' }] })
+
+    const response = await organizationsApi.listPermissions()
+
+    expect(request.get).toHaveBeenCalledWith('/permissions')
+    expect(response).toEqual({ data: [{ code: 'inventory.read' }] })
+  })
+
+  it('updates a role through its role endpoint', async () => {
+    const payload = { name: '仓库管理员', enabled: true, permission_codes: ['inventory.read'] }
+    request.put.mockResolvedValue({ data: null })
+
+    const response = await organizationsApi.updateRole(3, payload)
+
+    expect(request.put).toHaveBeenCalledWith('/roles/3', payload)
+    expect(response).toEqual({ data: null })
+  })
+})