---
title: "Assume"
method: POST
path: "/api/portal/auth/assume"
tags: ["portal-auth"]
---

# Assume

`POST /api/portal/auth/assume`

## Request

- Base URL: `https://api.riskcube.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api.riskcube.com/api/portal/auth/assume`
- Auth: none declared

Exchange an admin "View as customer" hand-off ticket for a short-lived,
READ-ONLY customer session. No DB lookup — the hand-off JWT is self-contained
and signed by us; the resulting session carries `impersonated_by`, which the
auth middleware treats as read-only.

## Request body

- AssumeBody
  - `token` string, required

## Response `200`

Successful Response

- unknown

## Other responses

- `422`: Validation Error

## Changes

- **2026-10-10** `ee7b5bd1ca63`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/riskcube/apis/slack-lead-manager/changes/api/portal/auth/assume/post.md)

---

[API](https://skmtc.dev/riskcube/apis/slack-lead-manager.md) - [All operations](https://skmtc.dev/riskcube/apis/slack-lead-manager/llms.txt) - [OpenAPI document](https://skmtc.dev/riskcube/apis/slack-lead-manager/revisions/c8976d6fad6b?raw)