anchor.diff:  -H "X-Killbill-CreatedBy: demo" \
   -X POST \
   --data-binary '{"amount":"12.4"}' \
  -"http://127.0.0.1:8080/1.0/kb/invoicePayments/288983f2-5143-47e4-b967-b8962fc699d1"
  +"http://127.0.0.1:8080/1.0/kb/invoicePayments/288983f2-5143-47e4-b967-b8962fc699d1/refunds"
   ----
   
   
  
positive.code: 
  == Play Time...
  
  Assuming our `cs` user knows about the `api_key` and `api_secret` of the tenant, he should now be able to make any api calls against that tenant (with the limitation of his permissions).
  
  So for instance, creating a new account in that tenant would work because his role `customer_support` includes the permission `account:create`:
  
  
negative.code: "http://127.0.0.1:8080/1.0/kb/accounts"
  ----
  
  But the following curl to refund a payment would fail because his role `customer_support` does not include the permission `payment:refund`:
  
  
  [source,bash]
  