Deepgram Enterprise RBAC

Contents

• Overview

• Prerequisites

• Instructions

• Output

• Error Handling

• Examples

• Resources

Overview

Implement role-based access control for enterprise Deepgram deployments with five roles (Admin, Developer, Analyst, Service, Auditor), scoped API keys, team management, permission middleware, and automated key rotation.

Prerequisites

• Deepgram enterprise account

• Multiple projects configured

• Team management system

• Audit logging enabled

Instructions

Step 1: Define Roles and Permissions

Create five roles with mapped Deepgram scopes: Admin (manage:, listen:, usage:, keys:), Developer (listen:, usage:read), Analyst (usage:read), Service (listen:), Auditor (usage:read, keys:read).

Step 2: Build RBAC Service

Implement user API key creation with role-based scopes. Keys are scoped to team projects with expiration dates (90 days for service accounts, 365 for users). Store key references, not keys themselves.

Step 3: Implement Permission Middleware

Create Express middleware that checks user permissions before route handlers. Return 401 for unauthenticated, 403 for unauthorized requests.

Step 4: Set Up Team Management

Create teams linked to Deepgram projects. Add/remove members with role assignment. Auto-provision/revoke API keys on membership changes.

Step 5: Enable API Key Rotation

Scan for keys expiring within 7 days. Revoke old key, create new key with same scopes, notify user. Run as scheduled job.

Step 6: Configure Audit Logging

Log all key creation, revocation, role changes, and permission denials with timestamps and actor IDs.

See detailed implementation for advanced patterns.

Output

• Five-role permission system with Deepgram scope mapping

• Scoped API key lifecycle management

• Express permission middleware

• Team-based access control

• Automated key rotation

• RBAC audit trail

Error Handling

Issue Cause Solution

Permission denied Wrong role Request role upgrade from admin

Key expired No rotation Enable auto-rotation job

Team not found Deleted team Verify team exists before operations

Scope mismatch Role change Revoke and recreate key on role update

Examples

Permission Scopes

Scope Description Roles

listen:*

All transcription Admin, Developer, Service

manage:*

All management Admin

usage:read

View usage Admin, Developer, Analyst, Auditor

keys:read

View API keys Admin, Auditor

keys:write

Create/delete keys Admin

Access Control Matrix

Action Admin Developer Analyst Service Auditor

Transcribe Yes Yes No Yes No

View usage Yes Yes Yes No Yes

Manage keys Yes No No No No

View audit Yes No No No Yes

Resources

• Deepgram API Key Management

• Project Management

• Enterprise Features