Impersonate a user

Start a session as one of your users, in one of their apps.

POST /organizations/{org}/impersonate

Returns a URL that signs you into an app as the given user, in the given tenant, so you see what they see. The URL carries a one-time authorization code, so the response is served Cache-Control: no-store.

Authorization

Org owner. Anyone else gets 403 forbidden.

Path parameters

Name	Type	Description
`org`	string	The organization: its id (`org_…`) or its slug. It has to be an org your token can manage (see Who can call it)

Body

Field	Type	Required	Description
`user_id`	string	yes	The user to become, `usr_…`
`tenant_id`	string	yes	The tenant to enter as, `tnt_…`
`client_id`	string	yes	The app to enter, `cli_…`

No other field is accepted.

Response

201 Created Open redirect_url to enter the app.

{ "redirect_url": "https://…" }

Errors

Status	`error`	When
`400`	`invalid_request`	An unknown field, or an id that is missing or of the wrong kind
`403`	`forbidden`	You are not an owner of the org
`404`	`not_found`	The user is not in that tenant, or the org is not yours
`422`	`unprocessable`	That client cannot receive an impersonated session

Example

curl -X POST https://loginwith.loginwith.dev/organizations/acme/impersonate \
  -H "Authorization: Bearer $TOKEN" -H "content-type: application/json" \
  -d '{"user_id": "usr_65f1c2a9e4b0d3f7a1c8e909", "tenant_id": "tnt_65f1c2a9e4b0d3f7a1c8e908", "client_id": "cli_65f1c2a9e4b0d3f7a1c8e902"}'