diff --git a/tools/service-identity/keycape_alias_disable.py b/tools/service-identity/keycape_alias_disable.py
index 6031efc..2a5f6b9 100755
--- a/tools/service-identity/keycape_alias_disable.py
+++ b/tools/service-identity/keycape_alias_disable.py
@@ -70,7 +70,9 @@ def session() -> dict:
 def alias_view() -> dict:
     view: dict = {}
     try:
-        view["roles"] = sorted(bao_json("list", "auth/keycape/role")["data"].get("keys", []))
+        listed = bao_json("list", "auth/keycape/role")  # `bao list -format=json` prints a bare array
+        keys = listed if isinstance(listed, list) else listed.get("data", {}).get("keys", [])
+        view["roles"] = sorted(str(k) for k in keys)
     except subprocess.CalledProcessError:
         view["roles"] = None
     try:
diff --git a/tools/service-identity/tests/test_keycape_alias_disable.py b/tools/service-identity/tests/test_keycape_alias_disable.py
index 873a3c9..ca5982f 100644
--- a/tools/service-identity/tests/test_keycape_alias_disable.py
+++ b/tools/service-identity/tests/test_keycape_alias_disable.py
@@ -25,7 +25,7 @@ elif args == ["read", "auth/token/lookup-self"]:
         sys.exit(2)
     out({"path": "auth/%s/oidc/callback" % state["session"], "policies": ["default", "platform-admin"]})
 elif args == ["list", "auth/keycape/role"]:
-    out({"keys": ["platform-admin"]})
+    print(json.dumps(["platform-admin"]))  # the real CLI prints a bare array for list
 elif args == ["read", "auth/keycape/config"]:
     out({"oidc_client_id": "openbao-admin", "default_role": "platform-admin", "oidc_client_secret": "never"})
 elif args[:2] == ["auth", "disable"]: