I am making the following api call...

 curl -H "Accept: application/xml" -H "X-Auth-Token: {my api key taken from keystone.conf}" http://localhost:35357/v2.0/users/{userId}/roles

which is returning the following error...

<error xmlns="http://docs.openstack.org/identity/api/v2.0" message="User roles not supported: tenant ID required" code="501" title="Not Implemented"/>

Am I doing something wrong or has this been deprecated or something? The documentation says I should be able to do this to get a user's global roles, although I'm not sure what the difference between global and non global is other than semantics!