---
title: "Generate an impersonation refresh token for a user by authId and appId"
method: POST
path: "/api/v1/users/{authId}/impersonation/{appId}"
tags: ["Users"]
---

# Generate an impersonation refresh token for a user by authId and appId

`POST /api/v1/users/{authId}/impersonation/{appId}`

## Request

- The document declares no server URL.
- Auth: OAuth 2
  - Client credentials
  - Token URL: `/oauth2/v1/token`

Required scope - root

## Path parameters

- `authId` string, required
- `appId` number, required

## Request body

- object
  - `impersonatorToken` string: The access token of the user impersonating, this user must be a super_admin

## Response `200`

A refresh token for impersonation

- object
  - `refresh_token` string: The refresh token for impersonation
  - `refresh_token_expires_on` number: The expiration time of the refresh token
  - `refresh_token_expires_in` number: The remaining time of the refresh token in seconds

## Changes

- **2025-04-22** `d9e10bff0b10`: 1 warning, 3 info
  - removed the optional property `refreshToken` from the response with the `200` status
  - added the optional property `refresh_token` to the response with the `200` status
  - added the optional property `refresh_token_expires_in` to the response with the `200` status
  - added the optional property `refresh_token_expires_on` to the response with the `200` status
- **2025-04-20** `598c545d2321`: 1 info
  - endpoint added
- **2024-08-11** `11e2773b3a1e`: 1 breaking
  - api path removed without deprecation

[Operation history](https://skmtc.dev/valuemelody/apis/melody-auth-s2s-api/changes/api/v1/users/:authId/impersonation/:appId/post.md)

---

[API](https://skmtc.dev/valuemelody/apis/melody-auth-s2s-api.md) - [All operations](https://skmtc.dev/valuemelody/apis/melody-auth-s2s-api/llms.txt) - [OpenAPI document](https://skmtc.dev/valuemelody/apis/melody-auth-s2s-api/revisions/52fa61c3fee7?raw)