---
title: "Mint an impersonation grant for the given user."
method: POST
path: "/api/v1/admin/impersonation"
tags: ["Admin"]
---

# Mint an impersonation grant for the given user.

`POST /api/v1/admin/impersonation`

## Request

- Base URL: `https://api.avatarfactory.io` (the document declares no server; this is the origin it was published from)
- URL: `https://api.avatarfactory.io/api/v1/admin/impersonation`
- Auth: one of:
  - API key in cookie `session`
  - HTTP bearer

<br/>If the request already carries an authentic grant (switching users<br/>mid-view), the old view is audited as ended first. An expired but<br/>authentic carried grant still closes its trail; only a tampered one<br/>is ignored. Grants are stateless, so a second browser session can<br/>hold its own open view; the trail closes each view it can see.

## Request body

- ImpersonationStartRequest
  - `email` string, required: Email of the user to view

## Response `200`

OK

- ImpersonationStartResponse
  - `token` string, required: Signed grant for the X-Impersonation-Grant header
  - `user` AdminUserView, required
    - `avatar_count` integer, required
    - `credit_balance` number, required: Remaining monthly credits
    - `display_name` string, nullable
    - `email` string, required
    - `id` integer, required
    - `plan` string, nullable: Active plan slug, None when unsubscribed
    - `video_count` integer, required

## Other responses

- `400`: Bad Request
- `403`: Forbidden
- `404`: Not Found
- `422`: Unprocessable Entity

---

[API](https://skmtc.dev/avatarfactory/apis/avatarfactory-api.md) · [All operations](https://skmtc.dev/avatarfactory/apis/avatarfactory-api/llms.txt) · [OpenAPI document](https://skmtc.dev/avatarfactory/apis/avatarfactory-api/revisions/66fc7aa3f296?raw)