apollo-enterprise-rbac

# Apollo Enterprise RBAC ## Overview Role-based access control for Apollo.io API integrations. Apollo API keys are all-or-nothing (standard vs master), so RBAC must be implemented in your application layer as a proxy between users and the Apollo API. This skill builds a permission matrix, scoped API key system, Express middleware, and admin audit endpoints. ## Prerequisites - Apollo master API key - Node.js 18+ with Express ## Instructions ### Step 1: Define Roles and Permission Matrix Map Apollo API operations to team roles. Apollo's API has two main categories: - **Read-only**: search (free), enrichment (credits) - **Write**: contacts CRUD, sequences, deals, tasks ```typescript // src/rbac/roles.ts export type Role = 'viewer' | 'analyst' | 'sales_rep' | 'sales_manager' | 'admin'; export interface Permission { searchPeople: boolean; // /mixed_people/api_search (free) searchOrganizations: boolean; // /mixed_companies/search (free) enrichPerson: boolean; // /people/match (1 credit) bulkEnrich: boolean; // /people/bulk_match (credits) enrichOrg: boolean; // /organizations/enrich (1 credit) manageContacts: boolean; // /contacts CRUD (master key) manageSequences: boolean; // /emailer_campaigns/* (master key) manageDeals: boolean; // /opportunities/* (master key) exportPII: boolean; // download contacts with email/phone viewAnalytics: boolean; // sequence stats, usage manageTeam: boolean; ...