---
title: "Start read-only impersonation — mint a 30-min view-as token (admin-email gated)"
method: POST
path: "/api/admin/impersonate"
tags: ["Admin"]
---

# Start read-only impersonation — mint a 30-min view-as token (admin-email gated)

`POST /api/admin/impersonate`

## Request

- Base URL: `https://api.witwiki.app`
- URL: `https://api.witwiki.app/api/admin/impersonate`
- Auth: HTTP bearer

Issues a short-lived, no-refresh access token carrying the target user's claims plus an `imp` claim (the admin). The token is **read-only**: any non-GET request made with it is rejected 403. Refuses to impersonate the admin or another admin account. Audit-logged as `admin.impersonate.start`.

## Request body

- object
  - `user_id` string, required
  - `org_id` string: Optional; defaults to the user's first membership

## Response `200`

Impersonation token + target user/org

- object
  - `access_token` string
  - `user` object
    - `id` string
    - `email` string
  - `org` object
    - `id` string
  - `role` string
  - `expires_at` string, date-time

## Other responses

- `400`: Invalid input
- `404`: Resource not found

---

[API](https://skmtc.dev/witwiki/apis/witwiki-api.md) · [All operations](https://skmtc.dev/witwiki/apis/witwiki-api/llms.txt) · [OpenAPI document](https://skmtc.dev/witwiki/apis/witwiki-api/revisions/cc93279a2dff?raw)