access

POST `/v1/access/impersonation/redeem`

Exchange a single-use impersonation ticket for a session token.

Xaqiijinta aqoonsiga

Bankigan (endpoint) waa mid dadweyne. Ma qaato wax aqoonsi ah ama urur ah — waa waxa ay site-keenna suuqgeynta iyo matoorada jawaabaha ee AI ay akhriyaan.

Boggan ma qaato aqoonsiga ururka. Furahaagu wuxuu horay u aqoonsanayaa ururka uu ka tirsan yahay, jawaabtuna waxay ku kooban tahay halkaas.

Isku day

Ku beddel wax kasta oo ku dhex jira qeebaha xaglaha ah qiimayaashaada, sidoo kalena haystaaha furaha ku beddel fure ka dhex muuqda dashboordigaaga.

curl -X POST https://api.zinndigital.com/v1/access/impersonation/redeem \
  -H "Content-Type: application/json" \
  -d '{ "ticket": <string> }'

Ma sign-garaysay? Qalabka API ee ku jira dashboard-kaagu wuxuu buuxiyaa aqoonsigaaga ururka ee dhabta ah iyo furahaaga gaarka ah, wuxuuna ku shaqeysiiyaa codsiga API-ga nool si aad u aragto jawaabta dhabta ah. Kani ka fur barta kontoroolka ee API

Faahfaahin

Called by the customer dashboard when a staff member follows an `ImpersonationGrant.url`. **Unauthenticated by design** — the caller is the app at the instant it has no session, which is the whole point. Authorisation is the ticket: single-use, five minutes, 32 bytes of entropy, stored only as a SHA-256 digest, and bound to a grant a staff member is on the audit log for opening. Every refusal returns the same 401 message. Distinguishing "no such ticket" from "already redeemed" from "expired" would tell a caller which of their guesses was once real.

Codsiga jidhkiisa

Magaca	Nooc	Loo baahan yahay	Maxay tahay
`ticket`	`string`	Haa	—

Jawaab

Magaca	Nooc	Loo baahan yahay	Maxay tahay
`token`	`string`	Haa	The customer session bearer token (carries the staff `act` claim).
`expires_at`	`string`	Haa	—
`session_id`	`string`	Haa	—
`org_id`	`string`	Haa	The single org this grant is good for.
`org_name`	`string`	Haa	—
`actor`	`string`	Haa	The real staff actor (`user:<id>`), for the banner.

Cilladaha ay bartaani soo celin karto

401 · 422 · 429 · 503

POST /v1/access/impersonation/redeem