auth.user.impersonate
curl --request POST \
--url https://platform.trylath.com/auth/user/impersonate \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"userId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"reason": "<string>"
}
'const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({userId: '3c90c3cc-0d44-4b50-8888-8dd25736052a', reason: '<string>'})
};
fetch('https://platform.trylath.com/auth/user/impersonate', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://platform.trylath.com/auth/user/impersonate"
payload = {
"userId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"reason": "<string>"
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://platform.trylath.com/auth/user/impersonate"
payload := strings.NewReader("{\n \"userId\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n \"reason\": \"<string>\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}{
"activityId": "<string>",
"result": {
"session": {
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"accessToken": "<string>",
"accessExpiresAt": "2023-11-07T05:31:56Z",
"endsAt": "2023-11-07T05:31:56Z"
},
"impersonating": {
"userId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"primaryEmail": "<string>",
"displayName": "<string>"
},
"reason": "<string>"
}
}auth.user.impersonate
Issues an access token that acts as this user, for support. A reason is required and is recorded on the session and in the audit trail. The session says ‘impersonation’ in the token’s amr, never carries the user’s MFA state, lasts at most thirty minutes whatever the environment’s session lifetime is, and cannot be refreshed — impersonate again to continue. A banned or deleted user cannot be impersonated.
POST
/
auth
/
user
/
impersonate
auth.user.impersonate
curl --request POST \
--url https://platform.trylath.com/auth/user/impersonate \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"userId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"reason": "<string>"
}
'const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({userId: '3c90c3cc-0d44-4b50-8888-8dd25736052a', reason: '<string>'})
};
fetch('https://platform.trylath.com/auth/user/impersonate', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://platform.trylath.com/auth/user/impersonate"
payload = {
"userId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"reason": "<string>"
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://platform.trylath.com/auth/user/impersonate"
payload := strings.NewReader("{\n \"userId\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n \"reason\": \"<string>\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}{
"activityId": "<string>",
"result": {
"session": {
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"accessToken": "<string>",
"accessExpiresAt": "2023-11-07T05:31:56Z",
"endsAt": "2023-11-07T05:31:56Z"
},
"impersonating": {
"userId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"primaryEmail": "<string>",
"displayName": "<string>"
},
"reason": "<string>"
}
}Authorizations
A Lath API key: lath_live_sk… or lath_test_sk… on a server, lath_live_pk… or lath_test_pk… in a browser.
Headers
Replays the stored response for the same key and input; refuses different input.
Body
application/json
Pattern:
^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$Why, in a sentence. Stored on the session and shown wherever it appears.
Required string length:
8 - 300Last modified on September 13, 2026
Was this page helpful?

