Skip to main content Início Criadores comeonoliver skillshub deepgram-enterprise-rbac
deepgram-enterprise-rbac Configure enterprise role-based access control for Deepgram integrations.
Use when implementing team permissions, managing API key scopes,
or setting up organization-level access controls.
Trigger: "deepgram RBAC", "deepgram permissions", "deepgram access control",
"deepgram team roles", "deepgram enterprise", "deepgram key scopes".
Ir para a instalação Skills Marketplace Descubra e explore skills de IA criadas pela comunidade.
Instalar com Codex ou Claude Copie este prompt, cole no Codex, Claude ou outro assistente e deixe que ele revise a página da skill e instale para você.
Mostrar detalhes do prompt Um comando direto ignora o prompt de revisão. Verifique a origem antes de executá-lo.
npx skills add https://github.com/ComeOnOliver/skillshub --skill deepgram-enterprise-rbacO comando permanece em uma só linha. Role horizontalmente para revisá-lo antes de copiar.
Prefere uma cópia local? Baixe os arquivos disponíveis atualmente no SkillsMP.
Baixar Zip Baixando... Mais deste repositório Review product and feature risk before an AI coding agent starts implementation.
Use Xquik for X data and confirmation-gated X actions: tweet search, user lookup, follower export, media download, monitors, webhooks, MCP, and SDK workflows.
Canton Network open-source ecosystem guide covering DAML SDK, Canton runtime, and Splice applications. Use when working with Canton Network, DAML smart contracts, or building decentralized applications.
Ocupações relacionadas SOC
Baseado na classificação ocupacional SOC
name deepgram-enterprise-rbac description Configure enterprise role-based access control for Deepgram integrations.
Use when implementing team permissions, managing API key scopes,
or setting up organization-level access controls.
Trigger: "deepgram RBAC", "deepgram permissions", "deepgram access control",
"deepgram team roles", "deepgram enterprise", "deepgram key scopes".
allowed-tools Read, Write, Edit, Bash(curl:*) version 1.0.0 license MIT author Jeremy Longshore <jeremy@intentsolutions.io> compatible-with claude-code, codex, openclaw tags ["saas","deepgram","api","rbac","enterprise"]
Deepgram Enterprise RBAC
Overview
Role-based access control for enterprise Deepgram deployments. Maps five application roles to Deepgram API key scopes, implements scoped key provisioning via the Deepgram Management API, Express permission middleware, team management with auto-provisioned keys, and automated key rotation.
Deepgram Scope Reference
Scope Permission Used By memberFull access (all scopes) Admin only listenSTT transcription Developers, Services speakTTS synthesis Developers, Services manageProject/key management Admin usage:readView usage metrics Analysts, Auditors keys:readList API keys Auditors keys:writeCreate/delete keys Admin
Instructions
Step 1: Define Roles and Scope Mapping
interface Role {
name : string ;
deepgramScopes : string [];
keyExpiry : number ;
description : string ;
}
const ROLES : Record <string , Role > = {
admin : {
name : 'Admin' ,
deepgramScopes : ['member' ],
keyExpiry : 90 ,
description : 'Full access — project and key management'
developer
name
'Developer'
deepgramScopes
'listen'
'speak'
keyExpiry
90
description
'STT and TTS — no management access'
analyst
name
'Analyst'
deepgramScopes
'usage:read'
keyExpiry
365
description
'Read-only usage metrics'
service
name
'Service Account'
deepgramScopes
'listen'
keyExpiry
90
description
'STT only — for automated systems'
auditor
name
'Auditor'
deepgramScopes
'usage:read'
'keys:read'
keyExpiry
30
description
'Read-only audit access'
Step 2: Scoped Key Provisioning import { createClient } from '@deepgram/sdk' ;
class DeepgramKeyManager {
private admin : ReturnType <typeof createClient>;
private projectId : string ;
constructor (adminKey : string , projectId : string this .admin = createClient (adminKey);
this .projectId = projectId;
}
async createScopedKey (userId : string , roleName : string ): Promise <{
keyId : string ;
key : string ;
scopes : string [];
expiresAt : string ;
}> {
const role = ROLES [roleName];
if (!role) throw new Error (`Unknown role: ${roleName} ` );
const expirationDate = new Date (Date .now () + role.keyExpiry * 86400000 );
const { result, error } = await this .admin .manage .createProjectKey (
this .projectId ,
{
comment : `${roleName} :${userId} :${new Date ().toISOString().split('T' )[0 ]} ` ,
scopes : role.deepgramScopes ,
expiration_date : expirationDate.toISOString (),
}
);
if (error) throw new Error (`Key creation failed: ${error.message} ` );
console .log (`Created ${roleName} key for ${userId} (expires ${expirationDate.toISOString().split('T' )[0 ]} )` );
return {
keyId : result.key_id ,
key : result.key ,
scopes : role.deepgramScopes ,
expiresAt : expirationDate.toISOString (),
};
}
async revokeKey (keyId : string const { error } = await this .admin .manage .deleteProjectKey (
this .projectId , keyId
);
if (error) throw new Error (`Key revocation failed: ${error.message} ` );
console .log (`Revoked key: ${keyId} ` );
}
async listKeys (const { result, error } = await this .admin .manage .getProjectKeys (this .projectId );
if (error) throw error;
return result.api_keys .map ((k : any ({
keyId : k.api_key_id ,
comment : k.comment ,
scopes : k.scopes ,
created : k.created ,
expiration : k.expiration_date ,
}));
}
}
Step 3: Permission Middleware import { Request , Response , NextFunction } from 'express' ;
interface AuthenticatedRequest extends Request {
user ?: { id : string ; role : string ; deepgramKeyId : string };
}
function requireRole (...allowedRoles : string [] ) {
return (req : AuthenticatedRequest , res : Response , next : NextFunction {
if (!req.user ) {
return res.status (401 ).json ({ error : 'Authentication required' });
}
if (!allowedRoles.includes (req.user .role )) {
console .warn (`Access denied: user ${req.user.id} (${req.user.role} ) tried to access ${req.path} ` );
return res.status (403 ).json ({
error : 'Insufficient permissions' ,
required : allowedRoles,
current : req.user .role ,
});
}
next ();
};
}
function requireScope (...requiredScopes : string [] ) {
return (req : AuthenticatedRequest , res : Response , next : NextFunction {
if (!req.user ) {
return res.status (401 ).json ({ error : 'Authentication required' });
}
const role = ROLES [req.user .role ];
const hasScopes = requiredScopes.every (
s =>deepgramScopes .includes (s) || role.deepgramScopes .includes ('member' )
);
if (!hasScopes) {
return res.status (403 ).json ({
error : 'Missing required Deepgram scopes' ,
required : requiredScopes,
current : role.deepgramScopes ,
});
}
next ();
};
}
app.post ('/api/transcribe' , requireScope ('listen' ), transcribeHandler);
app.post ('/api/tts' , requireScope ('speak' ), ttsHandler);
app.get ('/api/usage' , requireScope ('usage:read' ), usageHandler);
app.post ('/api/keys' , requireRole ('admin' ), createKeyHandler);
app.get ('/api/audit' , requireRole ('admin' , 'auditor' ), auditHandler);
Step 4: Team Management interface Team {
id : string ;
name : string ;
projectId : string ;
members : Array <{
userId : string ;
role : string ;
keyId : string ;
joinedAt : string ;
}>;
}
class TeamManager {
private keyManager : DeepgramKeyManager ;
constructor (adminKey : string , projectId : string this .keyManager = new DeepgramKeyManager (adminKey, projectId);
}
async addMember (team : Team , userId : string , role : string const key = await this .keyManager .createScopedKey (userId, role);
team.members .push ({
userId,
role,
keyId : key.keyId ,
joinedAt : new Date ().toISOString (),
});
console .log (`Added ${userId} to ${team.name} as ${role} ` );
return key;
}
async removeMember (team : Team , userId : string const member = team.members .find (m =>userId === userId);
if (!member) throw new Error (`User ${userId} not in team` );
await this .keyManager .revokeKey (member.keyId );
team.members = team.members .filter (m =>userId !== userId);
console .log (`Removed ${userId} from ${team.name} , key revoked` );
}
async changeRole (team : Team , userId : string , newRole : string const member = team.members .find (m =>userId === userId);
if (!member) throw new Error (`User ${userId} not in team` );
await this .keyManager .revokeKey (member.keyId );
const newKey = await this .keyManager .createScopedKey (userId, newRole);
member.role = newRole;
member.keyId = newKey.keyId ;
console .log (`Changed ${userId} role to ${newRole} ` );
return newKey;
}
}
Step 5: Automated Key Rotation async function rotateExpiringKeys (
keyManager : DeepgramKeyManager ,
db : any ,
daysBeforeExpiry = 7
) {
const keys = await keyManager.listKeys ();
const now = Date .now ();
const threshold = now + daysBeforeExpiry * 86400000 ;
let rotated = 0 ;
for (const key of keys) {
if (!key.expiration ) continue ;
const expiresAt = new Date (key.expiration ).getTime ();
if (expiresAt < threshold) {
const [role, userId] = (key.comment ?? '' ).split (':' );
if (!role || !userId) {
console .warn (`Cannot rotate key ${key.keyId} — unknown format: ${key.comment} ` );
continue ;
}
console .log (`Rotating key for ${userId} (${role} ), expires ${key.expiration} ` );
const newKey = await keyManager.createScopedKey (userId, role);
await db.query (
'UPDATE team_members SET key_id = $1 WHERE user_id = $2' ,
[newKey.keyId , userId]
);
await keyManager.revokeKey (key.keyId );
rotated++;
}
}
console .log (`Rotated ${rotated} keys expiring within ${daysBeforeExpiry} days` );
return rotated;
}
Step 6: Access Control Matrix Action Admin Developer Analyst Service Auditor Transcribe (STT) Yes Yes No Yes No Text-to-Speech Yes Yes No No No View usage Yes No Yes No Yes Manage keys Yes No No No No View audit logs Yes No No No Yes Create projects Yes No No No No
Output
Five-role permission model with Deepgram scope mapping
Scoped API key provisioning via Management API
Express middleware (role-based and scope-based)
Team management with auto-provisioned/revoked keys
Automated key rotation for expiring keys
Error Handling Issue Cause Solution 403 Forbidden Key lacks scope Create new key with correct scopes Key expired No rotation configured Enable automated rotation manage.createProjectKey failsAdmin key missing member scope Use key with member scope Team member can't transcribe Wrong role assigned Change role to developer or service
Resources 