Playground API
Enterprise Simulation Feature

Role-Based Access Control (RBAC) & Scope Permissions

Simulate realistic multi-tenant authorization workflows, test custom OAuth scopes, inspect descriptive 403 Forbidden payloads, and validate frontend permission guards without running complicated identity servers.

Interactive RBAC & Scope Permissions Studio

403 Simulator

Simulate role hierarchies, custom OAuth scopes, and test 403 Forbidden enforcement in real-time.

Response Inspector0 events logged

No Requests Dispatched Yet

Choose a role and action on the left, then click "Dispatch Request" to test 403 Forbidden vs 200 OK.

When X-Simulate-Role: viewer or custom scopes are sent, any mutating actions (POST/PATCH/DELETE) automatically produce realistic 403 Forbidden envelopes to test your app's UI error toasts and route guards.

Admin Persona

Full root access. Can read, create, update, delete any entity, and reset isolated session sandboxes.

admin / admin123
Editor Persona

Can read, create, and modify posts, comments, and todos. Destructive deletes return 403 Forbidden.

editor / editor123
Viewer Persona

Strictly read-only access. Any mutating request (POST, PUT, PATCH, DELETE) yields a 403 Forbidden.

viewer / viewer123
Guest Persona

Unauthenticated or public-only caller. Protected endpoints (like /auth/me) return 401 Unauthorized.

guest / (no token)

Default Permission Matrix

Action / ResourceAdminEditorViewerGuestRequired Scope
GET /posts, /users, etc.✅ Allowed✅ Allowed✅ Allowed✅ Allowed*:read, posts:read
POST /posts, /comments✅ Allowed✅ Allowed❌ 403 Forbidden❌ 403 Forbidden*:write, posts:write
PATCH /posts/:id✅ Allowed✅ Allowed❌ 403 Forbidden❌ 403 Forbidden*:write, posts:update
DELETE /posts/:id✅ Allowed❌ 403 Forbidden❌ 403 Forbidden❌ 403 Forbiddenposts:delete, admin
DELETE /session/reset✅ Allowed❌ 403 Forbidden❌ 403 Forbidden❌ 403 Forbiddenadmin only
GET /auth/me✅ Allowed✅ Allowed✅ Allowed❌ 401 Unauthorizedauthenticated

Integration Recipes & Usage

1. Simulation Headers (Zero Login Required)

Pass X-Simulate-Role and optional X-Simulate-Scopes directly in your fetch or Axios requests to instantly simulate unauthorized behavior.

javascript
1
// 1. Header-based simulation (instant, no login required)
2
fetch('https://playground.nileslabs.com/api/v1/posts/1', {
3
method: 'DELETE',
4
headers: {
5
'X-Simulate-Role': 'viewer', // Force viewer role
6
'X-Simulate-Scopes': 'posts:read', // Only read permission
7
'X-Enforce-RBAC': 'true'
8
}
9
})
10
.then(res => {
11
console.log('Status:', res.status); // 403 Forbidden
12
return res.json();
13
})
14
.then(error => {
15
console.error('RBAC Error:', error);
16
/* Output:
17
{
18
"error": "Forbidden: Insufficient role permissions",
19
"code": "RBAC_ROLE_FORBIDDEN",
20
"requiredRole": ["admin"],
21
"currentRole": "viewer",
22
"resource": "posts",
23
"action": "delete"
24
}
25
*/
26
});

2. Query Parameter Overrides

Append ?_role=viewer&_scopes=posts:read to any URL for simple GET requests, browser testing, or image tags.

javascript
1
// 2. Query param simulation (ideal for image tags & simple GETs)
2
const res = await fetch('https://playground.nileslabs.com/api/v1/posts?_role=guest&_scopes=public:read');
3
console.log(res.status); // 200 OK for public feed
4
5
const createRes = await fetch('https://playground.nileslabs.com/api/v1/posts?_role=viewer', {
6
method: 'POST',
7
headers: { 'Content-Type': 'application/json' },
8
body: JSON.stringify({ title: 'New Article', body: '...' })
9
});
10
console.log(createRes.status); // 403 Forbidden!

3. Official TypeScript SDK

Use client.setRole() or login with built-in personas in test suites.

typescript
1
// 3. Official TypeScript SDK with RBAC & Scope Simulation
2
import { PlaygroundClient } from 'playground-api';
3
4
const client = new PlaygroundClient({
5
identityToken: 'your_sandbox_token'
6
});
7
8
// A. Log in with a built-in preconfigured persona
9
await client.auth.login({
10
username: 'editor',
11
password: 'editor123'
12
});
13
14
// B. Or explicitly simulate a role / scopes on any request
15
client.setRole('viewer');
16
client.setScopes(['posts:read', 'users:read']);
17
18
try {
19
// Attempting to delete a post as a viewer will throw a 403 PlaygroundError
20
await client.posts.delete(1);
21
} catch (err: any) {
22
console.log(err.status); // 403
23
console.log(err.data.code); // 'RBAC_ROLE_FORBIDDEN'
24
console.log(err.data.requiredRole); // ['admin']
25
}

4. React & Next.js Route Guard Testing

Validate that your UI conditionally hides buttons (e.g. "Delete Article") or renders access denied banners when the user lacks required capabilities.

tsx
1
// 4. React / Next.js Client Component Route Guard Pattern
2
import { useEffect, useState } from 'react';
3
import { useRouter } from 'next/navigation';
4
5
export function AdminOnlyFeature() {
6
const [hasAccess, setHasAccess] = useState<boolean | null>(null);
7
const router = useRouter();
8
9
useEffect(() => {
10
// Check permission against Playground API
11
fetch('https://playground.nileslabs.com/api/v1/auth/me', {
12
headers: {
13
'X-Simulate-Role': 'viewer' // Simulating viewer for testing
14
}
15
})
16
.then(res => res.json())
17
.then(user => {
18
if (user.role !== 'admin') {
19
setHasAccess(false);
20
} else {
21
setHasAccess(true);
22
}
23
});
24
}, []);
25
26
if (hasAccess === null) return <div>Checking security clearance...</div>;
27
if (hasAccess === false) return <div className="text-red-500">403: Admin clearance required.</div>;
28
29
return <div>Welcome to the Admin Command Center!</div>;
30
}

Programmatic RBAC Discovery Endpoints

GET /auth/rolesDiscovery

Returns all supported roles, their descriptions, default scopes, and test credentials.

GET /auth/permissionsMatrix

Returns the granular permission matrix, allowed HTTP actions per role, and wildcard matching patterns.

PreviousInteractive API Studio
NextMock Payment Gateway