# Databunker

- [Databunker Pro](https://docs.databunker.org/pro/get-started/overview.md): Databunker Pro is a self-hosted secure vault and a safer alternative to traditional user tables in SQL and NoSQL databases. It encrypts sensitive data (PII, PHI, PCI, KYC) and the documents behind it — passports, contracts, ID scans — replacing them in your database with safe, random tokens, without…
- [Quickstart](https://docs.databunker.org/pro/get-started/quickstart.md): Run Databunker Pro locally in demo mode with a single Docker command, then create a user record and store an encrypted file through the API.
- [Performance & benchmarks](https://docs.databunker.org/pro/get-started/performance.md): Measured Databunker Pro throughput, detokenisation latency, and storage at 10M, 50M, and 100M records on dedicated AWS RDS PostgreSQL (plus a 10M Oracle comparison) — with a sizing guide for choosing database and application instances by record count.
- [PII Vault - PII Storage & Tokenization in Databunker Pro](https://docs.databunker.org/pro/get-started/pii-vault.md)
- [Architecture](https://docs.databunker.org/pro/get-started/architecture.md): How Databunker Pro is put together — backend storage options, the two-layer encryption and key management model, deployment and scaling topology, and the tokenization paths for user records and payment data.
- [Security overview](https://docs.databunker.org/pro/get-started/security-overview.md): Information security's primary focus is the balanced protection of confidentiality, integrity, and availability of data. This document reviews Databunker Pro's security features based on these core principles.
- [Licensing and limits](https://docs.databunker.org/pro/get-started/licensing.md): What a Databunker Pro license controls, what counts as a record, how many licenses a deployment needs, and how the vault behaves when the record cap or the expiry date is reached.
- [Frequently asked questions](https://docs.databunker.org/pro/get-started/faq.md)
- [Install with Docker Compose](https://docs.databunker.org/pro/installation/docker-compose.md): This page walks you through the steps to install Databunker Pro using Docker Compose.
- [Install with Kubernetes using Helm](https://docs.databunker.org/pro/installation/kubernetes-helm.md): This page walks you through the steps to install Databunker Pro on Kubernetes using Helm.
- [Generate admin credentials](https://docs.databunker.org/pro/installation/generate-admin-credentials.md): This page explains the steps needed to set up Databunker Pro for the first time.
- [Unattended installation](https://docs.databunker.org/pro/installation/unattended-installation.md): Complete the Databunker Pro first-time setup automatically over the API — no browser required — for CI/CD, infrastructure-as-code, and reproducible deployments.
- [Oracle Database backend](https://docs.databunker.org/pro/installation/oracle-database.md): Run Databunker Pro on Oracle Database — supported editions, connection settings, schema bootstrap, and a complete AWS RDS for Oracle setup including TLS.
- [Production checklist](https://docs.databunker.org/pro/installation/production-checklist.md): What to confirm before putting Databunker Pro in front of real users — keys, database, network, access control, backup, and monitoring.
- [Master key](https://docs.databunker.org/pro/administration/master-key.md): How Databunker Pro protects the master key with a wrapping key, why the master key is never exposed, and how the two independent wrappings enable rotation and recovery.
- [Wrapping key rotation](https://docs.databunker.org/pro/administration/key-rotation.md): How to rotate the Databunker Pro wrapping key using three Shamir key shares, what to back up before restarting, and what is recoverable if a key is lost.
- [Shamir key shares](https://docs.databunker.org/pro/administration/shamir-keys.md): How Databunker Pro splits the recovery key into five shares under a 3-of-5 threshold, and how to store, distribute, and audit them.
- [Backup and recovery](https://docs.databunker.org/pro/administration/backup-and-recovery.md): What to back up, how to restore, and how to export every record out of the vault — including the three artefacts a backup is useless without.
- [Monitoring](https://docs.databunker.org/pro/administration/monitoring.md): Scrape the Prometheus metrics endpoint, alert on the thresholds that matter, and cover the two things metrics cannot tell you — licence usage and database health.
- [Multi-tenancy](https://docs.databunker.org/pro/administration/multi-tenancy.md)
- [Conditional Role-Based Access Control (CRBAC)](https://docs.databunker.org/pro/administration/access-control.md)
- [Format-preserving tokenization](https://docs.databunker.org/pro/concepts/tokenization.md)
- [File Vault](https://docs.databunker.org/pro/concepts/file-vault.md): Store per-user files encrypted at rest, backed by local disk, Amazon S3, Google Cloud Storage, or Azure Blob Storage — with the same key management, multi-tenancy, and access control as the rest of Databunker Pro.
- [Fuzzy search](https://docs.databunker.org/pro/concepts/fuzzy-search.md)
- [Partial search](https://docs.databunker.org/pro/concepts/partial-search.md)
- [Record versioning](https://docs.databunker.org/pro/concepts/record-versioning.md)
- [Select security](https://docs.databunker.org/pro/concepts/select-security.md)
- [Sub-accounts](https://docs.databunker.org/pro/concepts/sub-accounts.md)
- [Shared records](https://docs.databunker.org/pro/concepts/shared-records.md)
- [Multi-jurisdiction deployment](https://docs.databunker.org/pro/concepts/global-deployment.md)
- [AWS Cognito vs Databunker Pro — PII Vault & Tokenization](https://docs.databunker.org/pro/comparisons/aws-cognito-alternative.md): LLM-built auth plus Databunker Pro — the modern replacement for AWS Cognito, with self-hosted PII vaulting and compliance built in.
- [HashiCorp Vault vs Databunker Pro — PII Storage & Compliance](https://docs.databunker.org/pro/comparisons/hashicorp-vault-alternative.md): HashiCorp Vault manages infrastructure secrets. Databunker Pro is a PII vault purpose-built for personal data protection, tokenization, and privacy compliance.
- [Custom PII Vault vs Databunker Pro — Build or Buy?](https://docs.databunker.org/pro/comparisons/custom-solution-alternative.md): What it actually takes to build a PII vault from scratch — and why most teams underestimate the effort by 10x.
- [Migrating to Databunker Pro](https://docs.databunker.org/pro/migrations/overview.md): How to move existing user records into Databunker Pro — the shared migration pattern, and which guide applies to your source system.
- [Migrate a SQL users table](https://docs.databunker.org/pro/migrations/sql-users-table.md): Move an existing SQL users table into Databunker Pro — build a token-only newusers table, backfill in chunks with UserCreateBulk, verify, then swap the tables.
- [Migrate from AWS Cognito](https://docs.databunker.org/pro/migrations/aws-cognito.md): Move user attributes out of a Cognito user pool into Databunker Pro — export with ListUsers, import with UserCreateBulk, then cut over authentication with a one-time password reset.
- [How-tos overview](https://docs.databunker.org/pro/howtos/overview.md): Short, task-focused guides for common Databunker Pro operations.
- [Update the license key](https://docs.databunker.org/pro/howtos/update-license.md): Apply a new license key to a running Databunker Pro instance.
- [Clean the users table](https://docs.databunker.org/pro/howtos/clean-users-table.md): Remove all user records and related data from a Databunker Pro instance.
- [Store user fields](https://docs.databunker.org/pro/howtos/store-user-fields.md): Choose between storing a whole user profile and tokenizing individual fields, and share a single field without handing out a credential.
- [Tokenize PII before it reaches an LLM](https://docs.databunker.org/pro/howtos/tokenize-llm-prompts.md): Replace personal data in a prompt with Databunker Pro tokens before calling a model, then restore the real values in the response.
- [Developer tools](https://docs.databunker.org/pro/developer-tools/overview.md)
- [API Overview](https://docs.databunker.org/pro/api/overview.md)
- [Authentication](https://docs.databunker.org/pro/api/authentication.md): Every credential type in Databunker Pro — root tokens, tenant tokens, role and user xtokens, and the bulk-unlock UUID — and how to obtain and use each one.
- [Errors](https://docs.databunker.org/pro/api/errors.md): Error response format, HTTP status codes, and a catalog of common error messages returned by the Databunker Pro API.
- [Pagination](https://docs.databunker.org/pro/api/pagination.md): How list endpoints paginate results in Databunker Pro — offset/limit parameters, the response envelope, and a worked example.
- [Create a new user token](https://docs.databunker.org/pro/api/user-tokenization/create-a-new-user-token.md): Creates a new user token with profile information and optional group/role assignment
- [Get user information](https://docs.databunker.org/pro/api/user-tokenization/get-user-information.md): Retrieves user information by login, token, or other identifiers
- [Update user profile](https://docs.databunker.org/pro/api/user-tokenization/update-user-profile.md): Updates user profile information
- [Patch user profile using JSON Patch](https://docs.databunker.org/pro/api/user-tokenization/patch-user-profile-using-json-patch.md): Updates user profile using JSON Patch operations (RFC 6902)
- [Delete user](https://docs.databunker.org/pro/api/user-tokenization/delete-user.md): Deletes a user and their associated data
- [Search users](https://docs.databunker.org/pro/api/user-tokenization/search-users.md): Searches for users using fuzzy matching. The search mode is auto-detected from the `identity` value: - If `identity` contains `@`, it is treated as an email search - Otherwise it searches across login, phone, and custom fields
- [List user versions](https://docs.databunker.org/pro/api/user-tokenization/list-user-versions.md): Lists all versions of a user's profile
- [Request user deletion](https://docs.databunker.org/pro/api/user-tokenization/request-user-deletion.md): Creates a deletion request for a user (requires approval)
- [Get user request](https://docs.databunker.org/pro/api/user-tokenization/get-user-request.md): Retrieves information about a specific user request
- [Cancel user request](https://docs.databunker.org/pro/api/user-tokenization/cancel-user-request.md): Cancels a pending user request
- [Approve user request](https://docs.databunker.org/pro/api/user-tokenization/approve-user-request.md): Approves a pending user request
- [List user requests](https://docs.databunker.org/pro/api/user-tokenization/list-user-requests.md): Lists all requests for a specific user
- [Request user update](https://docs.databunker.org/pro/api/user-tokenization/request-user-update.md): Creates an update request for a user (requires approval)
- [Request user patch](https://docs.databunker.org/pro/api/user-tokenization/request-user-patch.md): Creates a patch request for a user (requires approval)
- [Create multiple users in bulk](https://docs.databunker.org/pro/api/user-tokenization/create-multiple-users-in-bulk.md): Creates multiple users with their profiles and group information
- [Delete multiple users](https://docs.databunker.org/pro/api/user-tokenization/delete-multiple-users.md): Deletes several user records in one request. Each entry identifies a user by an indexed field. Entries that match no record are skipped, so `deleted` can be lower than `total`.
- [Store a file for a user](https://docs.databunker.org/pro/api/file-storage/store-a-file-for-a-user.md): Stores an encrypted file for a user. The file content is supplied as a base64-encoded `filedata` field. Each file is encrypted with a per-file key (wrapped by the user's record key) and stored in the configured object-storage backend (local disk, Amazon S3, Google Cloud Storage, or Azure Blob Storag…
- [Get a user file](https://docs.databunker.org/pro/api/file-storage/get-a-user-file.md): Returns the decrypted content of a user file. The file is selected by `fileuuid` (preferred) or by `filename`. When selecting by `filename`, the most recently created file with that name is returned. At least one of `fileuuid` or `filename` is required.
- [List user files](https://docs.databunker.org/pro/api/file-storage/list-user-files.md): Retrieves the metadata of all files owned by a user. File content is not returned.
- [Replace the tags on a file](https://docs.databunker.org/pro/api/file-storage/replace-the-tags-on-a-file.md): Replaces the complete tag set on a file. The supplied list is authoritative — tags not included are removed.
- [Delete a user file](https://docs.databunker.org/pro/api/file-storage/delete-a-user-file.md): Removes a user file, deleting both the stored object and its metadata.
- [Create bulk list unlock](https://docs.databunker.org/pro/api/bulk-operations/create-bulk-list-unlock.md): Creates an unlock mechanism for bulk list operations
- [List specific users in bulk](https://docs.databunker.org/pro/api/bulk-operations/list-specific-users-in-bulk.md): Looks up a batch of users by indexed field (`email`, `phone`, `login`, or `custom`) in a single call, returning the token and profile for each match. Requires a `unlockuuid` from `BulkListUnlock`.
- [List all users in bulk](https://docs.databunker.org/pro/api/bulk-operations/list-all-users-in-bulk.md): Lists all users using the bulk unlock mechanism with pagination
- [List users in group in bulk](https://docs.databunker.org/pro/api/bulk-operations/list-users-in-group-in-bulk.md): Lists users in a specific group using the bulk unlock mechanism
- [List all user requests in bulk](https://docs.databunker.org/pro/api/bulk-operations/list-all-user-requests-in-bulk.md): Lists all user requests using the bulk unlock mechanism with pagination
- [List files by tag across users](https://docs.databunker.org/pro/api/bulk-operations/list-files-by-tag-across-users.md): Lists file metadata for every file carrying the given tag, across all users in the tenant. Requires an `unlockuuid` from `BulkListUnlock`. Results are limited to the tags the caller's policy permits. File content is not returned.
- [List all audit events in bulk](https://docs.databunker.org/pro/api/bulk-operations/list-all-audit-events-in-bulk.md): Lists all audit events using the bulk unlock mechanism
- [List tokens in bulk](https://docs.databunker.org/pro/api/bulk-operations/list-tokens-in-bulk.md): Lists tokens using the bulk unlock mechanism
- [Delete tokens in bulk](https://docs.databunker.org/pro/api/bulk-operations/delete-tokens-in-bulk.md): Deletes multiple tokens using the bulk unlock mechanism
- [Create application data for user](https://docs.databunker.org/pro/api/app-data-management/create-application-data-for-user.md): Stores application-specific data for a user
- [Get application data for user](https://docs.databunker.org/pro/api/app-data-management/get-application-data-for-user.md): Retrieves application-specific data for a user
- [Update application data for user](https://docs.databunker.org/pro/api/app-data-management/update-application-data-for-user.md): Updates application-specific data for a user
- [List all application names](https://docs.databunker.org/pro/api/app-data-management/list-all-application-names.md): Retrieves a list of all application names in the system
- [List user application names](https://docs.databunker.org/pro/api/app-data-management/list-user-application-names.md): Retrieves a list of application names for a specific user
- [Delete application data for user](https://docs.databunker.org/pro/api/app-data-management/delete-application-data-for-user.md): Deletes application-specific data for a user
- [List app data versions](https://docs.databunker.org/pro/api/app-data-management/list-app-data-versions.md): Lists all versions of application data for a user
- [Request app data update](https://docs.databunker.org/pro/api/app-data-management/request-app-data-update.md): Creates an update request for app data (requires approval)
- [Create legal basis](https://docs.databunker.org/pro/api/legal-basis-management/create-legal-basis.md): Creates a new legal basis for data processing
- [Update legal basis](https://docs.databunker.org/pro/api/legal-basis-management/update-legal-basis.md): Updates an existing legal basis
- [Delete legal basis](https://docs.databunker.org/pro/api/legal-basis-management/delete-legal-basis.md): Deletes a legal basis
- [List legal basis agreements](https://docs.databunker.org/pro/api/legal-basis-management/list-legal-basis-agreements.md): Lists all legal basis agreements in the system
- [Accept agreement](https://docs.databunker.org/pro/api/agreement-management/accept-agreement.md): Records user's acceptance of a legal basis/agreement
- [Get user agreement](https://docs.databunker.org/pro/api/agreement-management/get-user-agreement.md): Retrieves a specific agreement for a user
- [List user agreements](https://docs.databunker.org/pro/api/agreement-management/list-user-agreements.md): Lists all agreements for a specific user
- [Cancel agreement](https://docs.databunker.org/pro/api/agreement-management/cancel-agreement.md): Cancels a user's agreement
- [Request agreement cancellation](https://docs.databunker.org/pro/api/agreement-management/request-agreement-cancellation.md): Creates a cancellation request for an agreement (requires approval)
- [Revoke all agreements](https://docs.databunker.org/pro/api/agreement-management/revoke-all-agreements.md): Revokes all agreements for a specific legal basis
- [Create processing activity](https://docs.databunker.org/pro/api/processing-activity-management/create-processing-activity.md): Creates a new processing activity
- [Update processing activity](https://docs.databunker.org/pro/api/processing-activity-management/update-processing-activity.md): Updates an existing processing activity
- [Delete processing activity](https://docs.databunker.org/pro/api/processing-activity-management/delete-processing-activity.md): Deletes a processing activity
- [Link processing activity to legal basis](https://docs.databunker.org/pro/api/processing-activity-management/link-processing-activity-to-legal-basis.md): Links a processing activity to a legal basis
- [Unlink processing activity from legal basis](https://docs.databunker.org/pro/api/processing-activity-management/unlink-processing-activity-from-legal-basis.md): Unlinks a processing activity from a legal basis
- [List processing activities](https://docs.databunker.org/pro/api/processing-activity-management/list-processing-activities.md): Lists all processing activities in the system
- [Create token for sensitive data](https://docs.databunker.org/pro/api/format-preserving-tokenization/create-token-for-sensitive-data.md): Creates a token for sensitive data like credit card numbers
- [Get token data](https://docs.databunker.org/pro/api/format-preserving-tokenization/get-token-data.md): Retrieves the original data for a given token
- [Delete token](https://docs.databunker.org/pro/api/format-preserving-tokenization/delete-token.md): Deletes a token and its associated data
- [Create multiple tokens in bulk](https://docs.databunker.org/pro/api/format-preserving-tokenization/create-multiple-tokens-in-bulk.md): Creates multiple tokens for sensitive data
- [Create a new group](https://docs.databunker.org/pro/api/group-management/create-a-new-group.md): Creates a new group for organizing users
- [Get group information](https://docs.databunker.org/pro/api/group-management/get-group-information.md): Retrieves information about a specific group
- [List all groups](https://docs.databunker.org/pro/api/group-management/list-all-groups.md): Retrieves a list of all groups in the system
- [Update group](https://docs.databunker.org/pro/api/group-management/update-group.md): Updates an existing group
- [Delete group](https://docs.databunker.org/pro/api/group-management/delete-group.md): Deletes a group
- [List user groups](https://docs.databunker.org/pro/api/group-management/list-user-groups.md): Lists all groups for a specific user
- [Add user to group](https://docs.databunker.org/pro/api/group-management/add-user-to-group.md): Adds a user to a specific group with optional role assignment
- [Remove user from group](https://docs.databunker.org/pro/api/group-management/remove-user-from-group.md): Removes a user from a specific group
- [Create a new role](https://docs.databunker.org/pro/api/role-management/create-a-new-role.md): Creates a new role for access control
- [Update role](https://docs.databunker.org/pro/api/role-management/update-role.md): Updates an existing role
- [Link policy to role](https://docs.databunker.org/pro/api/role-management/link-policy-to-role.md): Links a policy to a role for access control
- [Create a new policy](https://docs.databunker.org/pro/api/policy-management/create-a-new-policy.md): Creates a new access control policy
- [Update a policy](https://docs.databunker.org/pro/api/policy-management/update-a-policy.md): Updates an existing access control policy
- [Get policy information](https://docs.databunker.org/pro/api/policy-management/get-policy-information.md): Retrieves information about a specific policy
- [List all policies](https://docs.databunker.org/pro/api/policy-management/list-all-policies.md): Retrieves a list of all policies in the system
- [Create access token for user](https://docs.databunker.org/pro/api/authentication/create-access-token-for-user.md): Creates an access token for a specific user
- [Create access token for role](https://docs.databunker.org/pro/api/authentication/create-access-token-for-role.md): Creates an access token for a specific role
- [List user audit events](https://docs.databunker.org/pro/api/audit-management/list-user-audit-events.md): Retrieves audit events for a specific user
- [Get specific audit event](https://docs.databunker.org/pro/api/audit-management/get-specific-audit-event.md): Retrieves detailed information about a specific audit event
- [Create a new tenant](https://docs.databunker.org/pro/api/tenant-management/create-a-new-tenant.md): Creates a new tenant for multi-tenant setups
- [Get tenant information](https://docs.databunker.org/pro/api/tenant-management/get-tenant-information.md): Retrieves information about a specific tenant
- [Update tenant information](https://docs.databunker.org/pro/api/tenant-management/update-tenant-information.md): Updates information about a specific tenant
- [Delete a tenant](https://docs.databunker.org/pro/api/tenant-management/delete-a-tenant.md): Deletes a tenant and its records. The system tenant (id `1`) cannot be deleted.
- [List all tenants](https://docs.databunker.org/pro/api/tenant-management/list-all-tenants.md): Retrieves a list of all tenants in the system
- [Create shared record](https://docs.databunker.org/pro/api/shared-records/create-shared-record.md): Creates a shared record for a user with specific fields
- [Get shared record](https://docs.databunker.org/pro/api/shared-records/get-shared-record.md): Retrieves a shared record by its UUID
- [Upsert session](https://docs.databunker.org/pro/api/session-management/upsert-session.md): Creates or updates a user session
- [Delete session](https://docs.databunker.org/pro/api/session-management/delete-session.md): Deletes a user session
- [List user sessions](https://docs.databunker.org/pro/api/session-management/list-user-sessions.md): Lists all sessions for a specific user
- [Get session](https://docs.databunker.org/pro/api/session-management/get-session.md): Retrieves information about a specific session
- [Generate wrapping key from Shamir's Secret Sharing keys](https://docs.databunker.org/pro/api/system-operations/generate-wrapping-key-from-shamirs-secret-sharing-keys.md): Generates a wrapping key from three Shamir's Secret Sharing keys
- [Set the license key](https://docs.databunker.org/pro/api/system-operations/set-the-license-key.md): Applies a new license key to a running instance. Only the main tenant administrator (tenant id `1`) may call this. The key is validated before it is saved — an invalid or expired key is rejected and the existing license is left in place.
- [Get system statistics](https://docs.databunker.org/pro/api/system-operations/get-system-statistics.md): Retrieves system statistics including user counts, tenant counts, and other metrics
- [Get user report](https://docs.databunker.org/pro/api/system-operations/get-user-report.md): Generates a detailed report for a specific user
- [Get user profiles across all tenants](https://docs.databunker.org/pro/api/system-operations/get-user-profiles-across-all-tenants.md): Retrieves all profiles for a user identified by email, phone, login, or custom field across all tenants. Only accessible by the main tenant admin (tenantID=1). The `token` mode is not supported. Requires a bulk list unlock UUID obtained from `BulkListUnlock`.
- [Search user profiles across all tenants](https://docs.databunker.org/pro/api/system-operations/search-user-profiles-across-all-tenants.md): Fuzzy-searches for user profiles across all tenants by identity. The search mode is auto-detected from the `identity` value: - If `identity` contains `@`, it is treated as an email search - Otherwise it searches across login, phone, and custom fields Only accessible by the main tenant admin (tenantI…
- [Delete user profiles across all tenants](https://docs.databunker.org/pro/api/system-operations/delete-user-profiles-across-all-tenants.md): Deletes all profiles for a user identified by email, phone, login, custom field, or token across all tenants. An optional `tenantid` or `tenantname` parameter can restrict deletion to a single tenant. The `token` mode is only allowed when `tenantid` or `tenantname` is specified. Only accessible by t…
- [Restore a deleted user profile](https://docs.databunker.org/pro/api/system-operations/restore-a-deleted-user-profile.md): Restores a previously deleted user profile for a specific tenant from version history. The caller must provide the user `token` and either `tenantid` or `tenantname`. Only accessible by the main tenant admin (tenantID=1). Requires a bulk list unlock UUID obtained from `BulkListUnlock`.
- [Get user HTML report](https://docs.databunker.org/pro/api/system-operations/get-user-html-report.md): Generates an HTML report for a specific user
- [Databunker](https://docs.databunker.org/oss/get-started/overview.md)
- [Quickstart](https://docs.databunker.org/oss/get-started/quickstart.md)
- [Architecture](https://docs.databunker.org/oss/get-started/architecture.md)
- [Node.js examples](https://docs.databunker.org/oss/get-started/examples.md)
- [Detailed installation guide](https://docs.databunker.org/oss/installation/overview.md)
- [API Overview](https://docs.databunker.org/oss/api/overview.md)
- [Create a new user record](https://docs.databunker.org/oss/api/user/create-a-new-user-record.md): Creates a new encrypted user record. Databunker extracts `login`, `phone`, and `email` from the request and builds hashed indexes for lookup. These values must be unique across all users.
- [Get user by token](https://docs.databunker.org/oss/api/user/get-user-by-token.md): Retrieves a user record by their unique token
- [Update user by token](https://docs.databunker.org/oss/api/user/update-user-by-token.md): Updates a user record. When using JSON, you can remove fields by setting their value to null. All changes are logged in the audit trail.
- [Delete user by token](https://docs.databunker.org/oss/api/user/delete-user-by-token.md): Removes all user records from the database, keeping only the user token for reference. This fulfills the GDPR "right to be forgotten" requirement. In the enterprise version, deletion can be delayed according to company policy.
- [Get user by email](https://docs.databunker.org/oss/api/user/get-user-by-email.md): Retrieves a user record by email address
- [Update user by email](https://docs.databunker.org/oss/api/user/update-user-by-email.md): Updates a user record identified by email address
- [Delete user by email](https://docs.databunker.org/oss/api/user/delete-user-by-email.md): Removes all user records, fulfilling GDPR "right to be forgotten"
- [Get user by phone](https://docs.databunker.org/oss/api/user/get-user-by-phone.md): Retrieves a user record by phone number
- [Update user by phone](https://docs.databunker.org/oss/api/user/update-user-by-phone.md): Updates a user record identified by phone number
- [Delete user by phone](https://docs.databunker.org/oss/api/user/delete-user-by-phone.md): Removes all user records, fulfilling GDPR "right to be forgotten"
- [Get user by login](https://docs.databunker.org/oss/api/user/get-user-by-login.md): Retrieves a user record by login name
- [Update user by login](https://docs.databunker.org/oss/api/user/update-user-by-login.md): Updates a user record identified by login name
- [Delete user by login](https://docs.databunker.org/oss/api/user/delete-user-by-login.md): Removes all user records, fulfilling GDPR "right to be forgotten"
- [Get user app record by token](https://docs.databunker.org/oss/api/user-app/get-user-app-record-by-token.md): Retrieves app-specific data for a user
- [Create or update user app record by token](https://docs.databunker.org/oss/api/user-app/create-or-update-user-app-record-by-token.md): Stores additional information about a user for a specific application. This is useful for storing app-specific data (e.g., shipping info) separately from profile data. Submitting multiple times overwrites the previous value.
- [Delete user app record by token](https://docs.databunker.org/oss/api/user-app/delete-user-app-record-by-token.md): Removes app-specific data for a user
- [Get user app record by email](https://docs.databunker.org/oss/api/user-app/get-user-app-record-by-email.md): Retrieves app-specific data for a user identified by email
- [Create or update user app record by email](https://docs.databunker.org/oss/api/user-app/create-or-update-user-app-record-by-email.md): Stores app-specific data for a user identified by email
- [Delete user app record by email](https://docs.databunker.org/oss/api/user-app/delete-user-app-record-by-email.md): Removes app-specific data for a user identified by email
- [Get user app record by phone](https://docs.databunker.org/oss/api/user-app/get-user-app-record-by-phone.md): Retrieves app-specific data for a user identified by phone
- [Create or update user app record by phone](https://docs.databunker.org/oss/api/user-app/create-or-update-user-app-record-by-phone.md): Stores app-specific data for a user identified by phone
- [Delete user app record by phone](https://docs.databunker.org/oss/api/user-app/delete-user-app-record-by-phone.md): Removes app-specific data for a user identified by phone
- [Get user app record by login](https://docs.databunker.org/oss/api/user-app/get-user-app-record-by-login.md): Retrieves app-specific data for a user identified by login
- [Create or update user app record by login](https://docs.databunker.org/oss/api/user-app/create-or-update-user-app-record-by-login.md): Stores app-specific data for a user identified by login
- [Delete user app record by login](https://docs.databunker.org/oss/api/user-app/delete-user-app-record-by-login.md): Removes app-specific data for a user identified by login
- [List sessions by user token](https://docs.databunker.org/oss/api/session/list-sessions-by-user-token.md): Returns an array of all session records for a user
- [Create session by user token](https://docs.databunker.org/oss/api/session/create-session-by-user-token.md): Creates a new user session and returns a session token. Sessions can have an expiration TTL specified in the request.
- [List sessions by email](https://docs.databunker.org/oss/api/session/list-sessions-by-email.md): Returns all session records for a user identified by email
- [Create session by email](https://docs.databunker.org/oss/api/session/create-session-by-email.md): Creates a new session for a user identified by email
- [List sessions by phone](https://docs.databunker.org/oss/api/session/list-sessions-by-phone.md): Returns all session records for a user identified by phone
- [Create session by phone](https://docs.databunker.org/oss/api/session/create-session-by-phone.md): Creates a new session for a user identified by phone
- [List sessions by login](https://docs.databunker.org/oss/api/session/list-sessions-by-login.md): Returns all session records for a user identified by login
- [Create session by login](https://docs.databunker.org/oss/api/session/create-session-by-login.md): Creates a new session for a user identified by login
- [Get session data](https://docs.databunker.org/oss/api/session/get-session-data.md): Retrieves session data by session token
- [Delete session](https://docs.databunker.org/oss/api/session/delete-session.md): Deletes a session by session token
- [Get consent by user token](https://docs.databunker.org/oss/api/consent/get-consent-by-user-token.md): Retrieves consent record for a user
- [Create consent by user token](https://docs.databunker.org/oss/api/consent/create-consent-by-user-token.md): Stores user consent. The `brief` parameter is a unique consent identifier per user. Allowed characters: [a-z0-9-], max 64 characters.
- [Withdraw consent by user token](https://docs.databunker.org/oss/api/consent/withdraw-consent-by-user-token.md): Withdraws user consent (GDPR compliance)
- [Get consent by email](https://docs.databunker.org/oss/api/consent/get-consent-by-email.md): Retrieves consent record for a user identified by email
- [Create consent by email](https://docs.databunker.org/oss/api/consent/create-consent-by-email.md): Stores consent for a user identified by email
- [Withdraw consent by email](https://docs.databunker.org/oss/api/consent/withdraw-consent-by-email.md): Withdraws consent for a user identified by email
- [Get consent by phone](https://docs.databunker.org/oss/api/consent/get-consent-by-phone.md): Retrieves consent record for a user identified by phone
- [Create consent by phone](https://docs.databunker.org/oss/api/consent/create-consent-by-phone.md): Stores consent for a user identified by phone
- [Withdraw consent by phone](https://docs.databunker.org/oss/api/consent/withdraw-consent-by-phone.md): Withdraws consent for a user identified by phone
- [Get consent by login](https://docs.databunker.org/oss/api/consent/get-consent-by-login.md): Retrieves consent record for a user identified by login
- [Create consent by login](https://docs.databunker.org/oss/api/consent/create-consent-by-login.md): Stores consent for a user identified by login
- [Withdraw consent by login](https://docs.databunker.org/oss/api/consent/withdraw-consent-by-login.md): Withdraws consent for a user identified by login
- [List all consents by user token](https://docs.databunker.org/oss/api/consent/list-all-consents-by-user-token.md): Returns all consent records for a user
- [List all consents by email](https://docs.databunker.org/oss/api/consent/list-all-consents-by-email.md): Returns all consent records for a user identified by email
- [List all consents by phone](https://docs.databunker.org/oss/api/consent/list-all-consents-by-phone.md): Returns all consent records for a user identified by phone
- [List all consents by login](https://docs.databunker.org/oss/api/consent/list-all-consents-by-login.md): Returns all consent records for a user identified by login
- [Start user expiration flow](https://docs.databunker.org/oss/api/expiration/start-user-expiration-flow.md): Triggers the user expiration flow for data minimization compliance. Returns an expiration token that can be used to create retention/deletion links.
- [Retain user data](https://docs.databunker.org/oss/api/expiration/retain-user-data.md): Cancels expiration and retains user data. This link works in the browser without authentication.
- [Delete expired user data](https://docs.databunker.org/oss/api/expiration/delete-expired-user-data.md): Confirms deletion of expired user data. This link works in the browser without authentication.
- [Cancel user expiration](https://docs.databunker.org/oss/api/expiration/cancel-user-expiration.md): Cancels user account expiration. Requires admin or user token.
- [Get expiration status](https://docs.databunker.org/oss/api/expiration/get-expiration-status.md): Retrieves user expiration status. Requires admin or user token.
- [Backup database](https://docs.databunker.org/oss/api/system/backup-database.md): Dumps the internal database in SQL format (SQLite only). Requires root token authentication.

## OpenAPI Specs

- [openapi](/api-reference/openapi.json)
- [openapi](/oss/api/openapi.yml)
- [openapi](/pro/api/openapi.yml)