Live demo · multi-tenant SaaS API

Try to read another company's invoice.

TenantDesk is an invoicing API shared by many companies. Below, two real accounts are created on the live API. Use Ben's valid login to go after Acme's data and watch each request get blocked: by the membership check, by scoped queries, and by PostgreSQL row-level security underneath.

View the code on GitHub Built by Sadia Aliou Toure

1. Create two companies

Acme

Owner: not created yet
Client: -
Invoice: -

Globex

Owner: not created yet
Invoices: none

2. Attack it

Live requests

Requests to the live API appear here, newest first.

Demo accounts use random example.com addresses and passwords generated in your browser. Shared demo data may be cleared at any time.