Security
Enterprise

API Security Guide

Complete security implementation with OAuth2 authentication, JWT tokens, RBAC, and audit logging.

Security Architecture

MLGraph Security Layer
Authentication Layer
OAuth2 Server
JWT Validator
API Gateway / Rate Limiter
▼
RBAC Engine
Users Management
Organizations
Permissions Engine
▼
Audit & Compliance
Audit Logger
Compliance Reports
Analytics Dashboard

Authentication Methods

OAuth2 Server

  • Authorization code flow
  • Client credentials for service accounts
  • PKCE support for public clients
  • Token introspection endpoint

JWT Tokens

  • Access tokens (short-lived)
  • Refresh token rotation
  • Argon2 password hashing
  • MFA (TOTP/WebAuthn) support

Role-Based Access Control

Global Roles

RoleDescription
Super AdminFull system access
System OperatorManage system resources
Billing AdminAccess to billing/usage data
ViewerGlobal read-only access

Organization Roles

RolePermissions
OwnerFull org access, billing, delete org
AdminManage org users/resources
DeveloperCRUD on indices, read metrics
Data ScientistTrain/search operations
AnalystRead-only access to data

API Security Endpoints

# OAuth2 endpoints
POST   /oauth2/authorize
POST   /oauth2/token
POST   /oauth2/revoke
GET    /oauth2/introspect
GET    /oauth2/userinfo

# Authentication endpoints
POST   /api/v1/auth/login
POST   /api/v1/auth/logout
POST   /api/v1/auth/refresh
POST   /api/v1/auth/register
POST   /api/v1/auth/mfa/enable
POST   /api/v1/auth/mfa/verify

# User management
GET    /api/v1/users
GET    /api/v1/users/me
PUT    /api/v1/users/me
POST   /api/v1/users/me/change-password

# API Key management
GET    /api/v1/users/me/api-keys
POST   /api/v1/users/me/api-keys
DELETE /api/v1/users/me/api-keys/:id

Rate Limiting

TierPer MinutePer HourPer Day
Free601,00010,000
Basic30010,000100,000
Pro1,00050,000500,000
Enterprise10,000500,0005,000,000

Security Best Practices

Authentication

  • Argon2 password hashing
  • Account lockout after failed attempts
  • Strong password requirements
  • MFA (TOTP/WebAuthn)

Authorization

  • Least privilege principle
  • Resource-based permissions
  • Audit all permission changes
  • Regular permission reviews

Data Protection

  • Encrypt sensitive data at rest
  • TLS 1.3 for transport
  • Data retention policies
  • GDPR compliance

Monitoring

  • Log all authentication attempts
  • Monitor anomalous behavior
  • Alert on security events
  • Regular security audits

Compliance

GDPR
Right to be forgotten, data portability, consent management
SOC2
Access controls, audit logging, data encryption
HIPAA
PHI encryption, access controls, BAA support
Back to Getting StartedBack to Daemon Design