access

POST `/v1/access/impersonation/redeem`

Exchange a single-use impersonation ticket for a session token.

Tabbatar da Asali

Wannan yankin ƙarshen jama'a ne. Ba ya ɗaukar wata takardar shaida ko ƙungiya — shi ne abin da shafin kasuwancinmu da injunan amsa na AI ke karantawa.

Wannan wurin ƙarewa ba ya buƙatar ID na ƙungiya. Maɓallin ku ya riga ya gano ƙungiyar da yake ciki, kuma an iyakance amsa a kanta.

Gwada

May gurbin komai da ke cikin kusurwa da ƙimar ka, kuma may gurbin maballi da maballi daga allon sarrafa ka.

curl -X POST https://api.zinndigital.com/v1/access/impersonation/redeem \
  -H "Content-Type: application/json" \
  -d '{ "ticket": <string> }'

An shiga? Na'urar sarrafa API da ke cikin sashin kulawarka tana cika ainihin lambar ƙungiyarka da maɓallinka naka, sannan tana gudanar da buƙatar a kan ainihin API don haka zaka iya ganin amsar gaske. Buɗe wannan tashar a cikin na'urar kula da API

Bayani

Called by the customer dashboard when a staff member follows an `ImpersonationGrant.url`. **Unauthenticated by design** — the caller is the app at the instant it has no session, which is the whole point. Authorisation is the ticket: single-use, five minutes, 32 bytes of entropy, stored only as a SHA-256 digest, and bound to a grant a staff member is on the audit log for opening. Every refusal returns the same 401 message. Distinguishing "no such ticket" from "already redeemed" from "expired" would tell a caller which of their guesses was once real.

Jikin buƙata

Suna	Nau'i	Ana buƙata	Abin da yake
`ticket`	`string`	Eh	—

Martani

Suna	Nau'i	Ana buƙata	Abin da yake
`token`	`string`	Eh	The customer session bearer token (carries the staff `act` claim).
`expires_at`	`string`	Eh	—
`session_id`	`string`	Eh	—
`org_id`	`string`	Eh	The single org this grant is good for.
`org_name`	`string`	Eh	—
`actor`	`string`	Eh	The real staff actor (`user:<id>`), for the banner.

Kuskuren da wannan matsaya za ta iya maido wa

401 · 422 · 429 · 503

POST /v1/access/impersonation/redeem