deepgram-enterprise-rbac

name	deepgram-enterprise-rbac
description	Configure enterprise role-based access control for Deepgram integrations. Use when implementing team permissions, managing API key scopes, or setting up organization-level access controls. Trigger with phrases like "deepgram RBAC", "deepgram permissions", "deepgram access control", "deepgram team roles", "deepgram enterprise".
allowed-tools	Read, Write, Edit, Bash(kubectl:*), Bash(curl:*)
version	1.0.0
license	MIT
author	Jeremy Longshore <[e-mail]>

Deepgram Enterprise RBAC

Overview

Implement role-based access control for enterprise Deepgram deployments with team management and scoped permissions.

Prerequisites

• Deepgram enterprise account
• Multiple projects configured
• Team management system
• Audit logging enabled

Deepgram Permission Scopes

Scope	Description	Use Case
listen:*	All transcription operations	Production services
manage:*	All management operations	Admin users
usage:read	View usage data	Billing team
usage:write	Modify usage	Service accounts
keys:read	View API keys	Security audits
keys:write	Create/delete keys	Admin users

Role Definitions

// config/roles.ts
export interface Role {
  name: string;
  description: string;
  deepgramScopes: string[];
  appPermissions: string[];
}

export const roles: Record<string, Role> = {
  admin: {
    name: 'Administrator',
    description: 'Full access to all Deepgram resources',
    deepgramScopes: ['manage:*', 'listen:*', 'usage:*', 'keys:*'],
    appPermissions: ['*'],
  },
  developer: {
    name: 'Developer',
    description: 'Transcription and development access',
    deepgramScopes: ['listen:*', 'usage:read'],
    appPermissions: [
      'transcription:create',
      'transcription:read',
      'projects:read',
    ],
  },
  analyst: {
    name: 'Analyst',
    description: 'Read-only access to transcriptions and usage',
    deepgramScopes: ['usage:read'],
    appPermissions: [
      ,
      ,
      ,
    ],
  },
  : {
    : ,
    : ,
    : [],
    : [
      ,
      ,
    ],
  },
  : {
    : ,
    : ,
    : [, ],
    : [
      ,
      ,
      ,
    ],
  },
};

Implementation

RBAC Service

// services/rbac.ts
import { createClient } from '@deepgram/sdk';
import { roles, Role } from '../config/roles';
import { db } from './database';

interface User {
  id: string;
  email: string;
  role: string;
  teamId: string;
  apiKeyId?: string;
}

interface Team {
  id: string;
  name: string;
  projectId: string;
  members: string[];
}

export class RBACService {
  private adminClient;

  constructor(adminApiKey: string) {
    this.adminClient = createClient(adminApiKey);
  }

  async createUserApiKey(user: User): Promise<string> {
    const role = roles[user.role];
    if (!role) {
        ();
    }

     team =  db..({ : user. });
     (!team) {
        ();
    }

    
     { result, error } =  ...(
      team.,
      {
        : ,
        : role.,
        : .(role),
      }
    );

     (error)  error;

    
     db..(
      { : user. },
      { : { : result. } }
    );

    
     .(, user., {
      : result.,
      : user.,
      : role.,
    });

     result.;
  }

   (: ): <> {
     user =  db..({ : userId });
     (!user?.) ;

     team =  db..({ : user. });
     (!team) ;

     ...(
      team.,
      user.
    );

     db..(
      { : userId },
      { : { :  } }
    );

     .(, userId, {
      : user.,
    });
  }

   (
    : ,
    : 
  ): <> {
     user =  db..({ : userId });
     (!user)  ;

     role = roles[user.];
     (!role)  ;

    
     (role..())  ;

    
     role..(permission);
  }

   (: , : ): <> {
     role = roles[newRole];
     (!role) {
        ();
    }

     user =  db..({ : userId });
     (!user) {
        ();
    }

    
     (user.) {
       .(userId);
    }

    
     db..(
      { : userId },
      { : { : newRole } }
    );

    
     .({ ...user, : newRole });

     .(, userId, {
      : user.,
      newRole,
    });
  }

   (: ):  {
     days = role. ===  ?  : ;
     date =  ();
    date.(date.() + days);
     date;
  }

    (
    : ,
    : ,
    : <, >
  ): <> {
     db..({
      :  (),
      action,
      userId,
      details,
    });
  }
}

Permission Middleware

// middleware/authorization.ts
import { Request, Response, NextFunction } from 'express';
import { RBACService } from '../services/rbac';

const rbac = new RBACService(process.env.DEEPGRAM_ADMIN_KEY!);

export function requirePermission(permission: string) {
  return async (req: Request, res: Response, next: NextFunction) => {
    const userId = req.user?.id;

    if (!userId) {
      return res.status(401).json({ error: 'Unauthorized' });
    }

    const hasPermission = await rbac.checkPermission(userId, permission);

    if (!hasPermission) {
      return res.status(403).json({
        error: 'Forbidden',
        message: ,
      });
    }

    ();
  };
}


app.(
  ,
  (),
  transcribeHandler
);

app.(
  ,
  (),
  usageHandler
);

app.(
  ,
  (),
  createKeyHandler
);

Team Management

// services/teams.ts
import { RBACService } from './rbac';
import { db } from './database';

interface CreateTeamRequest {
  name: string;
  projectId: string;
  adminUserId: string;
}

export class TeamService {
  private rbac: RBACService;

  constructor(rbac: RBACService) {
    this.rbac = rbac;
  }

  async createTeam(request: CreateTeamRequest): Promise<string> {
    const teamId = crypto.randomUUID();

    // Create team
    await db.teams.insertOne({
      id: teamId,
      name: request.name,
      projectId: request.projectId,
      members: [request.adminUserId],
      createdAt: new Date(),
    });

    // Set admin as team admin
     db..(
      { : request. },
      { : { teamId, :  } }
    );

    
     user =  db..({ : request. });
     (user) {
       ..(user);
    }

     teamId;
  }

   (
    : ,
    : ,
    : 
  ): <> {
    
     db..(
      { : teamId },
      { : { : userId } }
    );

    
     db..(
      { : userId },
      { : { teamId, role } }
    );

    
     user =  db..({ : userId });
     (user) {
       ..(user);
    }
  }

   (: , : ): <> {
    
     ..(userId);

    
     db..(
      { : teamId },
      { : { : userId } }
    );

    
     db..(
      { : userId },
      { : { : , :  } }
    );
  }

   (: ): <{
    : ;
    : <{ : ; :  }>;
  }> {
     team =  db..({ : teamId });
     (!team)   ();

     usage =  db..([
      { : { : { : team. } } },
      {
        : {
          : ,
          : { :  },
        },
      },
    ]).();

     {
      : usage.( sum + u., ),
      : usage.( ({
        : u.,
        : u.,
      })),
    };
  }
}

API Key Rotation

// services/key-rotation.ts
import { RBACService } from './rbac';
import { db } from './database';

export class KeyRotationService {
  private rbac: RBACService;

  constructor(rbac: RBACService) {
    this.rbac = rbac;
  }

  async rotateExpiredKeys(): Promise<{
    rotated: number;
    failed: number;
  }> {
    const stats = { rotated: 0, failed: 0 };

    // Find users with keys expiring soon
    const expiringUsers = await db.users.find({
      keyExpiration: {
        $lt: new Date(Date.now() + 7 * 24 * 60 * 60 * 1000), // 7 days
      },
    }).toArray();

    for (const user of expiringUsers) {
       {
        
         ..(user.);

        
         ..(user);

        
         .(user);

        stats.++;
      }  (error) {
        .(, error);
        stats.++;
      }
    }

     stats;
  }

    (: ): <> {
    
    
  }
}

Admin Dashboard API

// routes/admin.ts
import express from 'express';
import { requirePermission } from '../middleware/authorization';
import { RBACService } from '../services/rbac';
import { TeamService } from '../services/teams';

const router = express.Router();
const rbac = new RBACService(process.env.DEEPGRAM_ADMIN_KEY!);
const teams = new TeamService(rbac);

// List all users
router.get(
  '/users',
  requirePermission('admin:users:read'),
  async (req, res) => {
    const users = await db.users.find({}).toArray();
    res.json({ users });
  }
);

// Update user role
router.patch(
  '/users/:id/role',
  requirePermission('admin:users:write'),
  async (req, res) => {
    const { role } = req.body;
    await rbac.updateUserRole(req.params.id, role);
    res.({ :  });
  }
);


router.(
  ,
  (),
   (req, res) => {
     teamId =  teams.(req.);
    res.({ teamId });
  }
);


router.(
  ,
  (),
   (req, res) => {
     usage =  teams.(req..);
    res.(usage);
  }
);


router.(
  ,
  (),
   (req, res) => {
     rbac.(req..);
     user =  db..({ : req.. });
     (user) {
       newKey =  rbac.(user);
      res.({ : , :  });
    }  {
      res.().({ :  });
    }
  }
);

  router;

Resources

• Deepgram API Key Management
• Project Management
• Enterprise Features

Next Steps

Proceed to deepgram-migration-deep-dive for complex migration scenarios.