Secure API: PII/PHI/KYC Database for User Records

This example demonstrates how to securely manage user records using our specialized API. It showcases how to:

Team Management: Create and manage team groups with role-based access control
Data Masking: Automatically mask sensitive data while exposing only the necessary fields
Bulk Operations: Secure listing of team members with automatic data protection
Access Control: Enable manager-level access with field-level security
Audit Trail: Track all access to team member data

ℹ️ All requests are executed in the sandbox environment (show/hide configuration).

Step 1: Create Team Group and Roles

Set up the team structure with manager and member roles.

// Create team group
const teamGroup = await api.createGroup('sales-team', 'Sales Team Group');
// Create roles for managers and members
const managerRole = await api.createRole('manager');
const memberRole = await api.createRole('team-member');
return { teamGroup, managerRole, memberRole,
 note: "Team group and roles created successfully"
};

Output (press on "Run code in sandbox" to see result):

Step 2: Create Team Members

Create multiple team members with various data fields.

// Create team members with different data
const member1 = await api.createUser({
    login: 'member1',
    email: 'member1@company.com',
    name: 'Alice Johnson',
    phone: '+1234567890',
    salary: '75000',
    department: 'Sales',
    performance_rating: '4.5'
}, {
    groupname: 'sales-team',
    rolename: 'team-member'
});
const member2 = await api.createUser({
    login: 'member2',
    email: 'member2@company.com',
    name: 'Bob Smith',
    phone: '+1234567891',
    salary: '82000',
    department: 'Sales',
    performance_rating: '4.2'
}, {
    groupname: 'sales-team',
    rolename: 'team-member'
});
const member3 = await api.createUser({
    login: 'member3',
    email: 'member3@company.com',
    name: 'Carol White',
    phone: '+1234567892',
    salary: '78000',
    department: 'Sales',
    performance_rating: '4.8'
}, {
    groupname: 'sales-team',
    rolename: 'team-member'
});
return { 
    member1, member2, member3,
    note: "Team members created with various data fields"
};

Output (press on "Run code" to see result):

Step 3: Create Manager and Add to Team

Create a manager user and add them to the team with manager role.

// Create manager user
const manager = await api.createUser({
    login: 'manager1',
    email: 'manager@company.com',
    name: 'David Lee',
    title: 'Sales Manager',
    department: 'Sales'
});
// Add manager to team group with manager role
const managerMembership = await api.addUserToGroup(
    'login',
    'manager1',
    'sales-team',
    'manager'
);
return { 
    manager, managerMembership,
    note: "Manager created and added to team with manager role"
};

Output (press on "Run code" to see result):

Step 4: Create Manager Access Policy

Create policy that allows managers to see team members' names and phones while masking other data.

✱ Access is granted only to name and phone number. All other fields will be masked.

// Create policy for manager access
const managerPolicy = await api.createPolicy({
    policyname: 'ManagerAccess',
    policy: {
        Effect: 'Allow',
        Principal: { Role: 'manager' },
        Action: ['UserGet', 'BulkListGroupUsers'],
        Resource: [
            '${target_group_members:role/team-member}.profile.name',
            '${target_group_members:role/team-member}.profile.phone',
            '${target_group_members:role/team-member}.group'
        ],
        Condition: {
            StringEquals: {
                '${user_group_id}': '${target_group_id}'
            }
        }
    }
});
// Link policy to manager role
await api.linkPolicy('manager', 'ManagerAccess');
return { 
    managerPolicy,
    note: "Manager policy created with access to names and phones only"
};

Output:

Step 5: Initialize Bulk Operations

Get an unlock UUID token for bulk operations.

✱ The bulk unlock UUID is valid for only a few seconds and expires automatically. You must include it in every bulk* request.

// Get unlock UUID for bulk operations
const bulkInit = await api.bulkListUnlock();
// Store unlock UUID for later use
window.stateData = {
    unlockUUID: bulkInit.unlockuuid
};
return { 
    bulkInit,
    note: "Bulk operations initialized with unlock UUID"
};

Output:

Step 6: Create Manager Access Token

Create an access token for the manager to use in subsequent operations.

// Create manager access token
const managerToken = await api.createXToken('login', 'manager1');
// Add token to state data (preserving unlock UUID)
window.stateData.managerToken = managerToken.xtoken;
return { 
    managerToken,
    note: "Manager access token created successfully"
};

Output:

Step 7: List Team Members with Manager Token

Use manager's token to list team members, demonstrating data masking.

✱ Access is granted only to name and phone number. All other fields will be masked.

// Switch to manager token
api.xBunkerToken = window.stateData.managerToken;
// List all team members using stored unlock UUID
const teamMembers = await api.bulkListGroupUsers(
    window.stateData.unlockUUID,
    'sales-team'
);
// Filter to show only team members (excluding manager)
const teamMemberRecords = teamMembers.rows.filter(user => user.rolename === 'team-member');
return { 
    teamMemberRecords,
    note: "Filtered list showing only team members with their accessible fields"
};

Output:

Step 8: Reset Access Token

Reset the API token back to the original admin token.

// Reset to original admin token
api.xBunkerToken = document.getElementById('apiToken').value;
return { 
    message: 'Token reset to original admin token',
    note: "API client restored to admin context"
};

Output:

👋 Databunker team is here

Contact us via hello@databunker.org
Book a demo call to see our secure database in action
We’ll customize a plan to match your project’s requirements and budget

Secure API: PII/PHI/KYC Database for User Records

Sandbox configuration

Step 1: Create Team Group and Roles

Step 2: Create Team Members

Step 3: Create Manager and Add to Team

Step 4: Create Manager Access Policy

Step 5: Initialize Bulk Operations

Step 6: Create Manager Access Token

Step 7: List Team Members with Manager Token

Step 8: Reset Access Token

👋 Databunker team is here