access

POST `/v1/access/impersonation/redeem`

Exchange a single-use impersonation ticket for a session token.

Uthibitishaji

Kituo hiki cha mwisho ni cha umma. Hakichukui kitambulisho wala shirika — ni kile ambacho tovuti yetu ya masoko na injini za majibu za AI zinasoma.

Endpoint hii haichukui kitambulisho cha shirika. Ufunguo wako tayari unalitambua shirika linalohusika, na jibu limewekewa kikomo kwa shirika hilo pekee.

Jaribu

Badilisha chochote kilicho ndani ya mabano ya pembe na maadili yako mwenyewe, na kishikiliaji cha ufunguo na ufunguo kutoka kwa dashibodi yako.

curl -X POST https://api.zinndigital.com/v1/access/impersonation/redeem \
  -H "Content-Type: application/json" \
  -d '{ "ticket": <string> }'

Umeingia kwenye akaunti? Dashibodi yako ya kiweko cha API inajaza kitambulisho chako halisi cha shirika na ufunguo wako mwenyewe, na kuendesha ombi dhidi ya API ya moja kwa moja ili uweze kuona jibu halisi. Fungua sehemu hii ya mwisho (endpoint) kwenye konsole ya API

Maelezo

Called by the customer dashboard when a staff member follows an `ImpersonationGrant.url`. **Unauthenticated by design** — the caller is the app at the instant it has no session, which is the whole point. Authorisation is the ticket: single-use, five minutes, 32 bytes of entropy, stored only as a SHA-256 digest, and bound to a grant a staff member is on the audit log for opening. Every refusal returns the same 401 message. Distinguishing "no such ticket" from "already redeemed" from "expired" would tell a caller which of their guesses was once real.

Mwili wa ombi

Jina	Aina	Inayohitajika	Kilicho hiki
`ticket`	`string`	Ndiyo	—

Majibu

Jina	Aina	Inayohitajika	Kilicho hiki
`token`	`string`	Ndiyo	The customer session bearer token (carries the staff `act` claim).
`expires_at`	`string`	Ndiyo	—
`session_id`	`string`	Ndiyo	—
`org_id`	`string`	Ndiyo	The single org this grant is good for.
`org_name`	`string`	Ndiyo	—
`actor`	`string`	Ndiyo	The real staff actor (`user:<id>`), for the banner.

Hitilafu ambazo mwisho huu unaweza kurudisha

401 · 422 · 429 · 503

POST /v1/access/impersonation/redeem