# /impersonate - Start impersonation (permission-based access)

**POST /impersonate**

Allows users with the `impersonate:users` permission (Staff and Owner roles, Owner organization only)
to impersonate another user, but only if that user has active consent enabled.
The impersonation token duration will match the user's consent settings.



## Servers
- Backend API server: https://my.nethesis.it/backend/api (Backend API server)


## Authentication methods
- Bearer auth


## Parameters



### Body: application/json (object)

- **user_id** (string)
  Logto ID of the user to impersonate



## Responses
### 200
Impersonation started successfully

#### Body: application/json (object)
- **code** (integer)

- **message** (string)

- **data** (object)


### 400
Bad request (cannot impersonate yourself, user not found, etc.)

#### Body: application/json (object)
- **code** (integer)
  HTTP error code

- **message** (string)
  Error message

- **data** (object)


### 403
Forbidden (insufficient permissions for impersonation, or already impersonating)

#### Body: application/json (object)
- **code** (integer)
  HTTP error code

- **message** (string)
  Error message

- **data** (object)


### 401
Unauthorized - invalid or missing token

#### Body: application/json (object)
- **code** (integer)

- **message** (string)

- **data** (object | null)



[Powered by Bump.sh](https://bump.sh)