---
title: "Impersonation Authorize"
method: POST
path: "/api/internal/auth0-actions/impersonation-authorize"
tags: ["auth0-actions"]
---

# Impersonation Authorize

`POST /api/internal/auth0-actions/impersonation-authorize`

Authorize an in-flight token exchange after resolving the actor identity.

## Request body

- Auth0ImpersonationAuthorizationRequest — Body for ``POST /api/internal/auth0-actions/impersonation-authorize``. Sent by the Auth0 Custom Action whose source lives at ``infra/app/auth0/auth0_actions/impersonation_token_exchange.js``. The Action passes through the actor / subject identifiers and the requested mode so the dock can resolve the canonical actor principal before letting the exchange complete.
  - `actorUserId` string, required — Auth0 ``user_id`` of the admin (token's ``sub``).
  - `actorEmail` string, nullable — Convenience for logging.
  - `targetUserId` string, required — Auth0 ``user_id`` to impersonate.
  - `targetEmail` string, nullable — Convenience for logging.
  - `mode` 'full' | 'readonly'

## Response `200`

Successful Response

- Auth0ImpersonationAuthorizationResponse — Body returned to the Auth0 Custom Action. The Action treats any non-2xx response (or ``allow=false``) as a denial and rejects the exchange. When ``allow`` is true, ``target_*`` fields carry the dock-resolved canonical target identity for the Post-Login Action to stamp onto the minted token — caller-supplied target email / principal values on the OAuth body are never trusted.
  - `allow` boolean, required
  - `actorPrincipal` string, nullable
  - `impersonationModuleTarget` string, nullable
  - `targetUserId` string, nullable
  - `targetEmail` string, nullable
  - `targetPrincipal` string, nullable
  - `reason` string, nullable

## Other responses

- `422` — Validation Error

---

[API](https://skmtc.dev/gocrisp/apis/crisp-app-dock.md) · [All operations](https://skmtc.dev/gocrisp/apis/crisp-app-dock/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/gocrisp/crisp-app-dock/revisions/e56bd3c1a9db/schema)