Databunker Pro Role Access Token Demo ✔️

Databunker Pro: Role Access Token Demo

A root token can read everything. Most services should not. This example shows how to mint a role access token that is scoped down to exactly one slice of your data — and then prove what it can and cannot reach. It covers:

Scoping to One App: A billing service that sees billing app data and nothing else
Scoping to a Group: The same access, restricted to customers in one region
Scoping by File Tag: A KYC reviewer that sees passports but not contracts
Cross-User Lookups: Tenant-wide search that still respects the group boundary

Every step runs against a live vault. Denials below are real API responses, not illustrations.

ℹ️ All requests are executed in the sandbox environment (show/hide configuration).

Step 1: Create the EU Customer

A customer inside the EU group, with app data and two documents

const user = await api.createUser({ email: 'eu@roledemo.com', name: 'EU Customer' });
// The group is what the group-scoped policies below will target
const group = await api.createGroup({ groupname: 'eu-customers' });
const membership = await api.addUserToGroup('email', 'eu@roledemo.com', 'eu-customers');
// Two kinds of app data — a scoped token should reach only one of them
const billing = await api.createAppData('email', 'eu@roledemo.com', 'billing', { plan: 'enterprise', mrr: 9000 });
const support = await api.createAppData('email', 'eu@roledemo.com', 'support', { openTickets: 3 });
// Two kinds of documents — a scoped token should reach only the tagged one
const passport = await api.createFile('email', 'eu@roledemo.com', 'passport.jpg',
    btoa('eu passport scan'), { tags: ['passport', 'kyc'] });
const contract = await api.createFile('email', 'eu@roledemo.com', 'contract.pdf',
    btoa('signed contract'), { tags: ['contract'] });
window.euReady = user.status === 'ok';
return {
    user, group, membership, billing, support, passport, contract,
    note: "Every response above should read status: ok. You are connected with the tenant root token, which can read all of this."
};

Step 2: Create the US Customer

A second customer with the same data, but outside the EU group

if (!window.euReady) {
    throw new Error('Please run Step 1 first — it must finish with status: ok');
}
// Same shape of data, but this user joins no group
const user = await api.createUser({ email: 'us@roledemo.com', name: 'US Customer' });
const billing = await api.createAppData('email', 'us@roledemo.com', 'billing', { plan: 'starter', mrr: 50 });
const passport = await api.createFile('email', 'us@roledemo.com', 'passport.jpg',
    btoa('us passport scan'), { tags: ['passport', 'kyc'] });
window.demoReady = user.status === 'ok';
return {
    user, billing, passport,
    note: "Both customers now hold a passport tagged passport+kyc. Only the EU one is in a group — that difference drives every denial below."
};

Step 3: Create an Access Token Limited to One App Record

Add a role, define a policy that names it as the Principal, link the two, then issue an access token that carries the role — reaching one app record for every customer, and nothing else

// The role comes first, so the policy can name it
await api.createRole({ rolename: 'billing-svc' });
// Principal pins the rule to that caller; Resource names the app: users.appdata.<appname>
await api.createPolicy({
    policyname: 'pol-billing-svc',
    policy: {
        Effect: 'Allow',
        Principal: { Role: 'billing-svc' },
        Action: ['AppdataCreate', 'AppdataGet', 'AppdataUpdate', 'AppdataListAppNames'],
        Resource: ['users.appdata.billing']
    }
});
await api.linkPolicy('billing-svc', 'pol-billing-svc');
// Mint an access token that carries this role
const issued = await api.createRoleXToken('billing-svc');
window.billingToken = issued.xtoken;
return {
    issued,
    note: "This xtoken is what you would hand to the billing service. It is not a root token. Because the Principal is set, the rule applies to billing-svc alone — link it elsewhere and it grants nothing."
};

Try it free — startups get $1,000 in credits

If you're an early-stage startup, we'll give you $1,000 in credits — enough to run Databunker Pro completely free for your first couple of months. Book a short setup call and we'll get you started and apply the discount automatically.

Book 15-Min Setup Call

Step 4: Prove the Scope

Connect as the billing service and try to step outside the policy

if (!window.billingToken) {
    throw new Error('Please run Step 3 first to issue the token');
}
if (!window.demoReady) {
    throw new Error('Please run Steps 1 and 2 first to create both customers');
}
// A second client, authenticated as the role rather than as root
const svc = new DatabunkerproAPI(
    document.getElementById('apiUrl').value,
    window.billingToken,
    document.getElementById('tenantName').value
);
return {
    'billing on EU customer - should succeed': await svc.getAppData('email', 'eu@roledemo.com', 'billing'),
    'billing on US customer - should succeed': await svc.getAppData('email', 'us@roledemo.com', 'billing'),
    'support app - should fail': await svc.getAppData('email', 'eu@roledemo.com', 'support'),
    'file API - should fail': await svc.listUserFiles('email', 'eu@roledemo.com'),
    note: "Billing is readable for every user. The support app and the file API are refused — the policy never mentioned them."
};

Step 5: Limit the Access Token to One User Group

Name the group alongside the app in the Resource list, issue a fresh token from that policy, and the identical request now works for a member and fails for everyone outside

if (!window.demoReady) {
    throw new Error('Please run Steps 1 and 2 first to create the demo data');
}
// Two resource types in one policy: the app, and the group it is limited to
await api.createPolicy({
    policyname: 'pol-billing-eu',
    policy: {
        Effect: 'Allow',
        Action: ['AppdataGet', 'AppdataListAppNames'],
        Resource: ['users.appdata.billing', 'users.group.eu-customers']
    }
});
await api.createRole({ rolename: 'billing-eu' });
await api.linkPolicy('billing-eu', 'pol-billing-eu');
const issued = await api.createRoleXToken('billing-eu');
const eu = new DatabunkerproAPI(
    document.getElementById('apiUrl').value,
    issued.xtoken,
    document.getElementById('tenantName').value
);
return {
    'EU customer, in group - should succeed': await eu.getAppData('email', 'eu@roledemo.com', 'billing'),
    'US customer, not in group - should fail': await eu.getAppData('email', 'us@roledemo.com', 'billing'),
    note: "Same app, same actions — but the US customer is now out of reach because they are not in eu-customers"
};

Step 6: Create an Access Token Limited to Tagged Files

A KYC reviewer role scoped to the passport and kyc tags — the listing comes back filtered, so the signed contract never shows up at all

if (!window.demoReady) {
    throw new Error('Please run Steps 1 and 2 first to create the demo data');
}
// The Resource names file tags: users.file.<tag>
await api.createPolicy({
    policyname: 'pol-kyc-svc',
    policy: {
        Effect: 'Allow',
        Action: ['FileGet', 'FileListUserFiles'],
        Resource: ['users.file.passport', 'users.file.kyc']
    }
});
await api.createRole({ rolename: 'kyc-svc' });
await api.linkPolicy('kyc-svc', 'pol-kyc-svc');
const issued = await api.createRoleXToken('kyc-svc');
const kyc = new DatabunkerproAPI(
    document.getElementById('apiUrl').value,
    issued.xtoken,
    document.getElementById('tenantName').value
);
const asRoot = await api.listUserFiles('email', 'eu@roledemo.com');
const asRole = await kyc.listUserFiles('email', 'eu@roledemo.com');
return {
    'root token sees': asRoot.files.map(f => `${f.filename} [${f.tags}]`),
    'kyc role sees': (asRole.files || []).map(f => `${f.filename} [${f.tags}]`),
    'appdata - should fail': await kyc.getAppData('email', 'eu@roledemo.com', 'billing'),
    note: "The listing is filtered, not just refused. contract.pdf is absent from the role's response entirely — the reviewer cannot tell it exists."
};

Step 7: Limit a File Search to One User Group

Bulk listing is default-deny, so the role carries a second policy just for the unlock — and a query that spans every customer still returns only rows inside the group

if (!window.demoReady) {
    throw new Error('Please run Steps 1 and 2 first to create the demo data');
}
// Tags and group in one policy
await api.createPolicy({
    policyname: 'pol-kyc-eu',
    policy: {
        Effect: 'Allow',
        Action: ['FileGet', 'FileListUserFiles', 'BulkListFilesByTag'],
        Resource: ['users.file.passport', 'users.file.kyc', 'users.group.eu-customers']
    }
});
// Bulk listing is default-deny and gated behind an unlock call, which is a
// separate action on a broader resource — so grant it with its own small policy
await api.createPolicy({
    policyname: 'pol-bulk-unlock',
    policy: {
        Effect: 'Allow',
        Action: ['BulkListUnlock'],
        Resource: ['users']
    }
});
await api.createRole({ rolename: 'kyc-eu' });
await api.linkPolicy('kyc-eu', 'pol-kyc-eu');
await api.linkPolicy('kyc-eu', 'pol-bulk-unlock');
const issued = await api.createRoleXToken('kyc-eu');
const kycEu = new DatabunkerproAPI(
    document.getElementById('apiUrl').value,
    issued.xtoken,
    document.getElementById('tenantName').value
);
// Same query, run as the role and as root, for comparison
const unlockRole = await kycEu.bulkListUnlock();
const asRole = await kycEu.bulkListFilesByTag(unlockRole.unlockuuid, 'passport', 0, 10);
const unlockRoot = await api.bulkListUnlock();
const asRoot = await api.bulkListFilesByTag(unlockRoot.unlockuuid, 'passport', 0, 10);
return {
    'root token rows': (asRoot.files || []).length,
    'kyc-eu role rows': (asRole.files || []).length,
    'US customer files, not in group - should fail': await kycEu.listUserFiles('email', 'us@roledemo.com'),
    note: "Both passports carry the passport tag, but the role returns only the EU customer's. The group boundary survives a tenant-wide search."
};

Step 8: Review What Was Issued

List the policies now defined in this tenant

const policies = await api.listPolicies();
return {
    policies,
    note: "Each role carries only the policies you linked to it. Rotating a service's access means re-issuing its xtoken, not changing your data."
};

Next Step

Want to get access to extended trial?

The sandbox above is a shared, disposable tenant. Generate a free trial key to run Databunker Pro on your own data — 1 million records for 30 days.

Book 15-Min Setup Call