Can the API impersonate a user when using the special key-based admin account?

When using the API, I'd like to be able to impersonate a user when using the special key-based admin account. 

Because our domain is SSO, there's not a way to get a user-specific bearer programtically via /auth/loginsso, so (for example) a POSTing to https://FQDN/TDWebApi/api/{appId}/tickets/{id}/feed causes the update to appear as though it was made via the special key-based account -- since it was.  However, since the API is performing on behalf of a user who is acting in our custom web app, we'd like the feed update to appear to come from the user -- more accurately representing the action.  If the special key-based admin account was able to impersonate the user on such a call then this update could accurately represent action by the user.

Is this possible?  Is there another way to accomplish this in our environment?

Tags API sso
Asked by Craig Ghareeb on Fri 11/24/23 9:55 PM Last edited Fri 11/24/23 9:56 PM
Sign In to leave feedback or contribute an answer

Answer (1)

This answer has been marked as the accepted answer
Mark Sayers Tue 11/28/23 8:28 AM

Hello Craig,

Unfortunately there is no way to "impersonate" a person via the API. To take an action on behalf of someone else, you have to be authenticated as them into the API.

Sincerely,
Mark Sayers
Sr Support Consultant, CS

No feedback