access

POST `/v1/access/impersonation/redeem`

Exchange a single-use impersonation ticket for a session token.

Authentication

This endpoint is public. It takes no credential and no organisation — it is what our own marketing site and AI answer engines read.

This endpoint takes no organisation id. Your key already identifies the organisation it belongs to, and the response is scoped to it.

Try it

Replace anything in angle brackets with your own values, and the key placeholder with a key from your dashboard.

curl -X POST https://api.zinndigital.com/v1/access/impersonation/redeem \
  -H "Content-Type: application/json" \
  -d '{ "ticket": <string> }'

Signed in? The API console in your dashboard fills in your real organisation id and your own key, and runs the request against the live API so you can see the actual response. Open this endpoint in the API console

Details

Called by the customer dashboard when a staff member follows an `ImpersonationGrant.url`. **Unauthenticated by design** — the caller is the app at the instant it has no session, which is the whole point. Authorisation is the ticket: single-use, five minutes, 32 bytes of entropy, stored only as a SHA-256 digest, and bound to a grant a staff member is on the audit log for opening. Every refusal returns the same 401 message. Distinguishing "no such ticket" from "already redeemed" from "expired" would tell a caller which of their guesses was once real.

Request body

Name	Type	Required	What it is
`ticket`	`string`	Yes	—

Response

Name	Type	Required	What it is
`token`	`string`	Yes	The customer session bearer token (carries the staff `act` claim).
`expires_at`	`string`	Yes	—
`session_id`	`string`	Yes	—
`org_id`	`string`	Yes	The single org this grant is good for.
`org_name`	`string`	Yes	—
`actor`	`string`	Yes	The real staff actor (`user:<id>`), for the banner.

Errors this endpoint can return

401 · 422 · 429 · 503

POST /v1/access/impersonation/redeem