> ## Documentation Index > Fetch the complete documentation index at: https://docs.trylath.com/llms.txt > Use this file to discover all available pages before exploring further. > ## Agent Instructions > Every Lath operation is POST https://platform.trylath.com/, with a JSON body and `Authorization: Bearer `. `email.send` is POST /email/send. > Branch on `error.code`, never on `error.message`. Every refusal also carries `error.fix`, which names the next step. > Send an `Idempotency-Key` header on any operation that is not retry-safe, so a retry cannot run it twice. > A `lath_test_` key emails only the account's own members and sends no SMS; a `lath_live_` key reaches real recipients and is billed. > The OpenAPI document, generated from the same registry as the routes, is at https://platform.trylath.com/openapi.json. # auth.user.impersonate > Issues an access token that acts as this user, for support. A reason is required and is recorded on the session and in the audit trail. The session says 'impersonation' in the token's amr, never carries the user's MFA state, lasts at most thirty minutes whatever the environment's session lifetime is, and cannot be refreshed — impersonate again to continue. A banned or deleted user cannot be impersonated. ## OpenAPI ````yaml /api-reference/openapi.json post /auth/user/impersonate openapi: 3.1.0 info: title: Lath API version: 0.1.0 description: >- Every operation is one POST. The same set is reachable over MCP, the SDK and the CLI; nothing is dashboard-only. servers: - url: https://platform.trylath.com description: This deployment security: [] paths: /auth/user/impersonate: post: tags: - auth summary: auth.user.impersonate description: >- Issues an access token that acts as this user, for support. A reason is required and is recorded on the session and in the audit trail. The session says 'impersonation' in the token's amr, never carries the user's MFA state, lasts at most thirty minutes whatever the environment's session lifetime is, and cannot be refreshed — impersonate again to continue. A banned or deleted user cannot be impersonated. operationId: auth.user.impersonate parameters: - name: Idempotency-Key in: header required: false schema: type: string description: >- Replays the stored response for the same key and input; refuses different input. requestBody: required: true content: application/json: schema: $schema: https://json-schema.org/draft/2020-12/schema type: object properties: userId: type: string format: uuid pattern: >- ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$ reason: type: string minLength: 8 maxLength: 300 description: >- Why, in a sentence. Stored on the session and shown wherever it appears. required: - userId - reason additionalProperties: false responses: '200': description: '{ activityId, result }. activityId is empty for reads.' content: application/json: schema: type: object properties: activityId: type: string description: The activity this call created, or empty for a read. result: $schema: https://json-schema.org/draft/2020-12/schema type: object properties: session: type: object properties: id: type: string format: uuid pattern: >- ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$ accessToken: type: string accessExpiresAt: type: string format: date-time pattern: >- ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d:[0-5]\d(?:\.\d+)?(?:Z|([+-](?:[01]\d|2[0-3]):[0-5]\d)))$ endsAt: type: string format: date-time pattern: >- ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d:[0-5]\d(?:\.\d+)?(?:Z|([+-](?:[01]\d|2[0-3]):[0-5]\d)))$ required: - id - accessToken - accessExpiresAt - endsAt additionalProperties: {} impersonating: type: object properties: userId: type: string format: uuid pattern: >- ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$ primaryEmail: type: - string - 'null' displayName: type: - string - 'null' required: - userId - primaryEmail - displayName additionalProperties: {} reason: type: string required: - session - impersonating - reason additionalProperties: {} required: - activityId - result '400': description: invalid_input or invalid_json '401': description: unauthenticated '403': description: forbidden '404': description: not_found '409': description: 'conflict: idempotency_mismatch, email_taken, last_key' '413': description: body_too_large '429': description: rate_limited security: - bearer: [] components: securitySchemes: bearer: type: http scheme: bearer description: >- A Lath API key: lath_live_sk… or lath_test_sk… on a server, lath_live_pk… or lath_test_pk… in a browser. ````