God-mode member impersonation endpoint

Shipped

June 15, 2026 at 5:20 PM UTC

Author

Kamo

Commit

4691299

POST /api/security/impersonate mints a fresh ***+OTK for an arbitrary member of the caller's current org, gated on the caller session carrying god mode (GD). Records the god admin's member id as SUDO_MEMBER_ID for audit. Same login-shaped session build as EnterAsController, but same-org and god-gated rather than cross-org.