Admin

Start read-only impersonation — mint a 30-min view-as token (admin-email gated)

Issues a short-lived, no-refresh access token carrying the target user's claims plus an imp claim (the admin). The token is read-only: any non-GET request made with it is rejected 403. Refuses to impersonate the admin or another admin account. Audit-logged as admin.impersonate.start.

post/api/admin/impersonate

Request

  • Base URL: https://api.witwiki.app
  • URL: https://api.witwiki.app/api/admin/impersonate
  • Auth: HTTP bearer

Request body

user_idstring required
org_idstring

Optional; defaults to the user's first membership

Response

Impersonation token + target user/org

access_tokenstring
rolestring
expires_atstring date-time

Changes

No recorded changes to this operation across all 1 revision of this API.