Skip to main content

Sign in as another user (super admin)

POST 
/api/v1/system/users/:uid/impersonate

Mints a 30-minute access token that acts as the user, with their real membership role in the chosen organization. There is no refresh token and no session row: the user's own sessions are untouched, and when the token expires the caller is back on their own session.

The token cannot reach super-admin routes, cannot change the user's credentials (password, 2FA, passkeys), cannot create tokens or sessions in their name, and cannot start another impersonation. Those requests answer 403 with code IMPERSONATION_FORBIDDEN. Every audit event written with it carries impersonated_by, and starting one records auth.impersonation_started in the user's organization.

Refused with 403 IMPERSONATION_FORBIDDEN when the target is a super admin, the caller themselves, or the shared demo account, or when the caller's own token is an impersonation token. Answers 404 when the user does not exist, is not a member of orgSlug, or when auth.impersonation_enabled is false.

Request​

Responses​

Impersonation token (no refresh token)