Parameters
JSON body
Request body
application/jsontargetContactExternalIdstringRequiredshop__contact.external_id of the member to impersonate — same handle used in admin URLs.
Length: 8–24
/bff/impersonate/start
Mints a short-lived session bound to the member behind targetContactExternalId, rotates the AUTH cookie to it, and records the start event in core__activity. Rejects (403 / 400 depending on cause) when any safety invariant fails — see features/impersonate/startImpersonation.ts for the enforced list.
ImpersonatepostBffImpersonateStart
Response schema
1 status code documented
200Success
state"ok"RequiredtargetobjectRequiredcontactExternalIdstringRequiredfullNamestringRequiredemailstring | nullRequiredOne of 2:
Variant 1
string
Variant 2
null
expiresAtstringRequiredISO timestamp when the impersonation session expires (4 hours from now).
Response example
application/json{
"state": "ok",
"target": {
"contactExternalId": "example_contactExternalId",
"fullName": "example_fullName"
},
"expiresAt": "example_expiresAt"
}Request example
POST /bff/impersonate/start
curl -X POST "https://api.bizkithub.com/bff/impersonate/start" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer YOUR_API_KEY" \
-d '{
"targetContactExternalId": "example_targetContactExternalId"
}'Need an API key?
All BizKitHub public API endpoints require authentication via API key.