A Python client library for interacting with the DatabunkerPro API. This library provides a simple and intuitive interface for managing user data, tokens, and other DatabunkerPro features.
You can install the package using pip:
pip install databunkerpro
Or install directly from GitHub:
pip install git+https://github.com/securitybunker/databunkerpro-python.git
You need a Databunker Pro instance to talk to. Demo mode gives you one in a single command — no database, no configuration, everything held in memory:
docker run -p 3000:3000 -d --rm --name databunkerpro securitybunker/databunkerpro demo
Check that it came up:
docker logs databunkerpro
Databunker Pro demo is ready
Web UI: http://localhost:3000/
Root access token: DEMO
Database: in-memory, erased on restart
The root access token in demo mode is the fixed string DEMO. Save this as quickstart.py:
import base64 from databunkerpro import DatabunkerproAPI api = DatabunkerproAPI("http://localhost:3000", "DEMO") # Create a user record. The vault encrypts the profile and returns a user token. created = api.create_user({ "email": "[email protected]", "name": "John Doe", "phone": "+15551234567", }) print("User token:", created["token"]) # Read the record back by any indexed field: token, login, email, phone, custom. user = api.get_user("email", "[email protected]") print("Profile:", user["profile"]) # Store an encrypted file against that user, tagged by document type. filedata = base64.b64encode(b"fake passport scan bytes").decode() file = api.create_file( "email", "[email protected]", "passport.jpg", filedata, {"tags": ["passport", "kyc"]}, ) print("File uuid:", file["fileuuid"], "| tags:", file["tags"]) # List the user's files, filtered by tag. listing = api.list_user_files("email", "[email protected]", "kyc") print("Files tagged kyc:", [f["filename"] for f in listing["files"]]) # Fetch the file back. Content returns base64-encoded in filedata. fetched = api.get_file("email", "[email protected]", fileuuid=file["fileuuid"]) print("Decrypted:", base64.b64decode(fetched["filedata"]).decode()) # Delete user record. api.delete_user("email", "[email protected]") print("User deleted")
python quickstart.py
User token: c6688d6a-a87e-d332-2086-31c69fef4564
Profile: {'email': '[email protected]', 'name': 'John Doe', 'phone': '+15551234567'}
File uuid: c8517c4c-14f9-2e9d-2413-610b982065e8 | tags: ['kyc', 'passport']
Files tagged kyc: ['passport.jpg']
Decrypted: fake passport scan bytes
User deleted
Tags are lowercased, de-duplicated and sorted on write, which is why they come back in a different order than they were sent.
When you are done, stop the instance. It was started with --rm, so the container and its in-memory database are discarded:
docker stop databunkerpro
Demo mode is for evaluation only. The database is in memory, the wrapping key is a fixed public value, and the root token is the well-known string
DEMO. Never point it at real personal data. For a real deployment see the installation guide.
from databunkerpro import DatabunkerproAPI api = DatabunkerproAPI( base_url="https://your-databunker-instance.com", x_bunker_token="your-api-token", x_bunker_tenant="your-tenant-name", # multi-tenant deployments only ) # Update user information api.update_user("email", "[email protected]", { "name": "John Updated", "phone": "+0987654321", }) # Tokenize sensitive data token_result = api.create_token("creditcard", "4111111111111111") print(f"Created token in base format (credit card): {token_result['tokenbase']}") print(f"Created token in uuid format: {token_result['tokenuuid']}")
Files are attached to a user and can carry tags for later lookup:
# Replace the complete tag set on a file. This overwrites, it does not merge. api.replace_file_tags("email", "[email protected]", file["fileuuid"], ["archived"]) api.delete_file("email", "[email protected]", file["fileuuid"])
Files can also be listed by tag across every user in the tenant, which needs a bulk-unlock uuid first:
unlock = api.bulk_list_unlock() tagged = api.bulk_list_files_by_tag(unlock["unlockuuid"], "archived", 0, 100)
- User Management
- App Data Management
- File Storage
- Tokenization
- Legal Basis & Agreement Management
- Processing Activity Management
- Group Management
- Role & Policy Management
- Session Management
- Shared Records
- Bulk Operations
- Audit Management
- Tenant Management
- Authentication & Access Tokens
- System Operations
Python-specific:
- Type hints and comprehensive documentation
- Error handling and validation
- Continuous security scanning (Semgrep SAST, pinned CI actions)
To set up the development environment:
- Clone the repository:
git clone https://github.com/securitybunker/databunkerpro-python.git
cd databunkerpro-python- Install development dependencies:
pip install -e ".[dev]"- Run tests:
pytest
This library is scanned on every push and pull request, with a weekly scheduled sweep to catch drift:
- SAST (Semgrep): static analysis using the
p/python,p/secrets,p/security-audit, andp/owasp-top-tenrulesets. A finding fails the check, and results are published to the repository's Code Scanning tab. See.github/workflows/semgrep.yml. - Supply-chain hardening: every GitHub Action is pinned to a full commit SHA, so a mutable tag (
@v4) cannot be silently repointed to malicious code.
Reproduce the SAST scan locally:
pip install semgrep
semgrep scan \
--config p/python \
--config p/secrets \
--config p/security-audit \
--config p/owasp-top-tenTo report a security vulnerability, please email [email protected] rather than opening a public issue.
Contributions are welcome! Please feel free to submit a Pull Request.
- Fork the repository
- Create your feature branch (
git checkout -b feature/amazing-feature) - Commit your changes (
git commit -m 'Add some amazing feature') - Push to the branch (
git push origin feature/amazing-feature) - Open a Pull Request
This project is licensed under the MIT License - see the LICENSE file for details.
If you encounter any issues or have questions, please open an issue on GitHub.
For detailed API documentation, please visit the DatabunkerPro API Documentation.