Databunker Pro Role Access Token Demo ✔️

Databunker Pro: Role Access Token Demo

A root token can read everything. Most services should not. This example shows how to mint a role access token that is scoped down to exactly one slice of your data — and then prove what it can and cannot reach. It covers:

Scoping to One App: A billing service that sees billing app data and nothing else
Scoping to a Group: The same access, restricted to customers in one region
Scoping by File Tag: A KYC reviewer that sees passports but not contracts
Cross-User Lookups: Tenant-wide search that still respects the group boundary

Every step runs against a live vault. Denials below are real API responses, not illustrations.

ℹ️ All requests are executed in the sandbox environment (show/hide configuration).

Step 1: Set Up Two Customers

One customer in the EU group, one outside it. Each gets app data and documents.

// Two customers — only the first belongs to the EU group
await api.createUser({ email: 'eu@roledemo.com', name: 'EU Customer' });
await api.createUser({ email: 'us@roledemo.com', name: 'US Customer' });
await api.createGroup({ groupname: 'eu-customers' });
await api.addUserToGroup('email', 'eu@roledemo.com', 'eu-customers');
// Two kinds of app data — a scoped token should reach only one of them
await api.createAppData('email', 'eu@roledemo.com', 'billing', { plan: 'enterprise', mrr: 9000 });
await api.createAppData('email', 'us@roledemo.com', 'billing', { plan: 'starter', mrr: 50 });
await api.createAppData('email', 'eu@roledemo.com', 'support', { openTickets: 3 });
// Two kinds of documents — a scoped token should reach only the tagged ones
await api.createFile('email', 'eu@roledemo.com', 'passport.jpg',
    btoa('eu passport scan'), { tags: ['passport', 'kyc'] });
await api.createFile('email', 'eu@roledemo.com', 'contract.pdf',
    btoa('signed contract'), { tags: ['contract'] });
await api.createFile('email', 'us@roledemo.com', 'passport.jpg',
    btoa('us passport scan'), { tags: ['passport', 'kyc'] });
window.demoReady = true;
return {
    users: ['eu@roledemo.com (in eu-customers)', 'us@roledemo.com (no group)'],
    appdata: ['billing on both users', 'support on the EU user'],
    files: ['passport.jpg tagged passport+kyc on both', 'contract.pdf tagged contract on the EU user'],
    note: "You are currently connected with the tenant root token, which can read all of this"
};

Step 2: One App, All Users

A billing service that may touch billing app data — for any customer, but nothing else

if (!window.demoReady) {
    throw new Error('Please run Step 1 first to create the demo data');
}
// The Resource names the app: users.appdata.<appname>
await api.createPolicy({
    policyname: 'pol-billing-svc',
    policy: {
        Effect: 'Allow',
        Action: ['AppdataCreate', 'AppdataGet', 'AppdataUpdate', 'AppdataListAppNames'],
        Resource: ['users.appdata.billing']
    }
});
await api.createRole({ rolename: 'billing-svc' });
await api.linkPolicy('billing-svc', 'pol-billing-svc');
// Mint an access token that carries this role
const issued = await api.createRoleXToken('billing-svc');
window.billingToken = issued.xtoken;
return {
    issued,
    note: "This xtoken is what you would hand to the billing service. It is not a root token."
};

Try it free — startups get $1,000 in credits

If you're an early-stage startup, we'll give you $1,000 in credits — enough to run Databunker Pro completely free for your first couple of months. Book a short setup call and we'll get you started and apply the discount automatically.

Book 15-Min Setup Call

Step 3: Prove the Scope

Connect as the billing service and try to step outside the policy

if (!window.billingToken) {
    throw new Error('Please run Step 2 first to issue the token');
}
// A second client, authenticated as the role rather than as root
const svc = new DatabunkerproAPI(
    document.getElementById('apiUrl').value,
    window.billingToken,
    document.getElementById('tenantName').value
);
return {
    'billing on EU customer': await svc.getAppData('email', 'eu@roledemo.com', 'billing'),
    'billing on US customer': await svc.getAppData('email', 'us@roledemo.com', 'billing'),
    'support app (not granted)': await svc.getAppData('email', 'eu@roledemo.com', 'support'),
    'files (not granted)': await svc.listUserFiles('email', 'eu@roledemo.com'),
    note: "Billing is readable for every user. The support app and the file API are refused — the policy never mentioned them."
};

Step 4: One App, One Group of Users

Add a group to the Resource list and the same access narrows to that group's members

if (!window.demoReady) {
    throw new Error('Please run Step 1 first to create the demo data');
}
// Two resource types in one policy: the app, and the group it is limited to
await api.createPolicy({
    policyname: 'pol-billing-eu',
    policy: {
        Effect: 'Allow',
        Action: ['AppdataGet', 'AppdataListAppNames'],
        Resource: ['users.appdata.billing', 'users.group.eu-customers']
    }
});
await api.createRole({ rolename: 'billing-eu' });
await api.linkPolicy('billing-eu', 'pol-billing-eu');
const issued = await api.createRoleXToken('billing-eu');
const eu = new DatabunkerproAPI(
    document.getElementById('apiUrl').value,
    issued.xtoken,
    document.getElementById('tenantName').value
);
return {
    'EU customer (in group)': await eu.getAppData('email', 'eu@roledemo.com', 'billing'),
    'US customer (not in group)': await eu.getAppData('email', 'us@roledemo.com', 'billing'),
    note: "Same app, same actions — but the US customer is now out of reach because they are not in eu-customers"
};

Step 5: A Group of Files, by Tag

A KYC reviewer that sees identity documents — and does not even learn that other documents exist

if (!window.demoReady) {
    throw new Error('Please run Step 1 first to create the demo data');
}
// The Resource names file tags: users.file.<tag>
await api.createPolicy({
    policyname: 'pol-kyc-svc',
    policy: {
        Effect: 'Allow',
        Action: ['FileGet', 'FileListUserFiles'],
        Resource: ['users.file.passport', 'users.file.kyc']
    }
});
await api.createRole({ rolename: 'kyc-svc' });
await api.linkPolicy('kyc-svc', 'pol-kyc-svc');
const issued = await api.createRoleXToken('kyc-svc');
const kyc = new DatabunkerproAPI(
    document.getElementById('apiUrl').value,
    issued.xtoken,
    document.getElementById('tenantName').value
);
const asRoot = await api.listUserFiles('email', 'eu@roledemo.com');
const asRole = await kyc.listUserFiles('email', 'eu@roledemo.com');
return {
    'root token sees': asRoot.files.map(f => `${f.filename} [${f.tags}]`),
    'kyc role sees': (asRole.files || []).map(f => `${f.filename} [${f.tags}]`),
    'appdata (not granted)': await kyc.getAppData('email', 'eu@roledemo.com', 'billing'),
    note: "The listing is filtered, not just refused. contract.pdf is absent from the role's response entirely — the reviewer cannot tell it exists."
};

Step 6: Tagged Files, One Group — Cross-User Lookup

Search every customer's documents at once, with the group boundary still enforced

if (!window.demoReady) {
    throw new Error('Please run Step 1 first to create the demo data');
}
// Tags and group in one policy
await api.createPolicy({
    policyname: 'pol-kyc-eu',
    policy: {
        Effect: 'Allow',
        Action: ['FileGet', 'FileListUserFiles', 'BulkListFilesByTag'],
        Resource: ['users.file.passport', 'users.file.kyc', 'users.group.eu-customers']
    }
});
// Bulk listing is default-deny and gated behind an unlock call, which is a
// separate action on a broader resource — so grant it with its own small policy
await api.createPolicy({
    policyname: 'pol-bulk-unlock',
    policy: {
        Effect: 'Allow',
        Action: ['BulkListUnlock'],
        Resource: ['users']
    }
});
await api.createRole({ rolename: 'kyc-eu' });
await api.linkPolicy('kyc-eu', 'pol-kyc-eu');
await api.linkPolicy('kyc-eu', 'pol-bulk-unlock');
const issued = await api.createRoleXToken('kyc-eu');
const kycEu = new DatabunkerproAPI(
    document.getElementById('apiUrl').value,
    issued.xtoken,
    document.getElementById('tenantName').value
);
// Same query, run as the role and as root, for comparison
const unlockRole = await kycEu.bulkListUnlock();
const asRole = await kycEu.bulkListFilesByTag(unlockRole.unlockuuid, 'passport', 0, 10);
const unlockRoot = await api.bulkListUnlock();
const asRoot = await api.bulkListFilesByTag(unlockRoot.unlockuuid, 'passport', 0, 10);
return {
    'root token rows': (asRoot.files || []).length,
    'kyc-eu role rows': (asRole.files || []).length,
    'US customer files': await kycEu.listUserFiles('email', 'us@roledemo.com'),
    note: "Both passports carry the passport tag, but the role returns only the EU customer's. The group boundary survives a tenant-wide search."
};

Step 7: Review What Was Issued

List the policies now defined in this tenant

const policies = await api.listPolicies();
return {
    policies,
    note: "Each role carries only the policies you linked to it. Rotating a service's access means re-issuing its xtoken, not changing your data."
};

Next Step

See Databunker Pro in Action

Book a 15-min setup call and we'll get Databunker running for you in minutes. No technical work required on your end.

Book 15-Min Setup Call