---
title: "Auth Impersonate Create"
method: POST
path: "/auth/impersonate/"
tags: ["authentication"]
---

# Auth Impersonate Create

`POST /auth/impersonate/`

Endpoint for Respan admins to impersonate users for support purposes.

Security: gated on the ``staff_impersonate`` session scope (Phase 9
prereq #4 of the staff step-up auth roadmap). The scope is held
SEPARATELY from ``staff_read`` / ``staff_write`` so operators can
revoke impersonation from a specific admin via
``APIUser.has_impersonation_access`` without revoking cross-org
read/write powers.

Per-user authority:
- ``has_impersonation_access=True`` (default) → user can claim the
  ``staff_impersonate`` scope via ``/auth/jwt/scope/``.
- ``has_impersonation_access=False`` → ``get_staff_authority``
  excludes ``staff_impersonate`` from the user's set, so the scope
  cannot be claimed. Existing API-key admins on the transitional
  flag belt re-check the field too.

Start-impersonation requires the scope; stop-impersonation is
deliberately ALLOWED without it so an operator can flip the lever
to terminate in-flight sessions and the actor retains clean
termination of their own session.

ACTOR vs EFFECTIVE identity: during impersonation the JWT get_user()
hook (``KeywordsAIJWTAuthentication.get_user``) swaps ``request.user``
to the TARGET and stashes the real admin on ``impersonated_by_admin``.
Start/stop state lives on the ACTOR (the admin), not the target — so
we resolve ``actor`` here before calling ``impersonate_user()``.
Without this, stop-impersonation hits the target (who is not
impersonating anyone) and returns ``success=False`` (HTTP 400).

## Headers

- `Authorization` string, required

## Response `200`

No response body

- AuthenticationAuthImpersonateCreateResponse200 — Empty response body

---

[API](https://skmtc.net/keywordsai/apis/api-reference.md) · [All operations](https://skmtc.net/keywordsai/apis/api-reference/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/keywordsai/api-reference/versions/c26d550029f8/schema)