--- title: "How do I impersonate another user or role?" slug: "how-do-i-use-the-impersonation-feature" updated: 2025-02-06T17:33:22Z published: 2025-02-06T17:33:22Z canonical: "support.lusid.com/how-do-i-use-the-impersonation-feature" --- > ## Documentation Index > Fetch the complete documentation index at: https://support.lusid.com/llms.txt > Use this file to discover all available pages before exploring further. # How do I impersonate another user or role? With LUSID’s impersonation feature, you can allow particular privileged accounts to impersonate another user or role when making a request to [APIs in the FINBOURNE platform](/v1/docs/understanding-all-the-applications-in-the-finbourne-platform). For example, you could grant a service user account impersonation privileges that your business’s trusted subsystem can use to operate on behalf of a user in LUSID. To enable impersonation in LUSID, [contact us.](https://www.finbourne.com/contact) Once enabled, to use the impersonation feature: 1. [Set up a service user account with impersonation privileges.](/v1/docs/how-do-i-use-the-impersonation-feature#setting-up-a-service-user-account-with-impersonation-privileges) 2. [Send an impersonated API request.](/v1/docs/how-do-i-use-the-impersonation-feature#sending-an-impersonated-request) ## Setting up a service user account with impersonation privileges To use the impersonation feature, you must create a [service user](/v1/docs/what-are-a-personal-user-and-a-service-user) account and assign them a role containing the correct policy. To do this: 1. Sign in to the [LUSID web app](https://www.lusid.com/app/home) with the credentials of a LUSID administrator. 2. From the top left menu, navigate to **Identity and Access > Roles**. [Create a new role](/v1/docs/how-do-i-create-a-role) `allow-user-impersonation` with the assigned system policy `lusid-system-allow-user-impersonation`. 3. From the top left menu, navigate to **Identity and Access > Users**. [Create a service user account](/v1/docs/how-do-i-set-up-a-service-user-account) with the following assigned roles: You can also assign the service user additional roles of your choice. [See how to assign a role to a user.](/v1/docs/how-do-i-assign-policies-roles-and-users-to-each-other-using-the-api) > [!NOTE] > **Note** > > When creating the service user account, you must specify a **Login**. We recommend you specify a value that explicitly indicates it is your impersonating user, for example **impersonator@acme.com**. - `allow-user-impersonation` - `lusid-administrator` 4. [Create a Personal Access Token (PAT) for the service user](/v1/docs/how-do-i-create-or-revoke-a-long-lived-personal-access-token). All impersonated requests will require this PAT, so ensure you store the PAT securely. ## Sending an impersonated request A service user with impersonation privileges can send a FINBOURNE platform API request with additional headers to make the request as either: - [A particular user, using a user ID or login](/v1/docs/how-do-i-use-the-impersonation-feature#impersonating-a-user) - [One or more particular roles](/v1/docs/how-do-i-use-the-impersonation-feature#impersonating-one-or-more-roles) ### Impersonating a user To impersonate an existing LUSID user and their assigned roles in a request, you must include **one** of the following HTTP headers: - `X-LUSID-Run-As-User`, specifying the [user ID](/v1/docs/what-is-a-user-id-and-how-do-i-discover-one) you intend to impersonate. For example, to call the [ListPortfolios](https://www.lusid.com/docs/api/lusid/endpoints/portfolios/ListPortfolios) API as Jane Smith whose user ID is `00um073pwk8WMVC8Z2p7`, you might send the following request: ```shell curl -X GET "https://.lusid.com/api/api/portfolios?limit=3"  -H "X-LUSID-Run-As-User: 00um073pwk8WMVC8Z2p7"  -H "Authorization: Bearer " ``` - `X-LUSID-Run-As-Login`, specifying the unique login of the user you intend to impersonate. For example, to call the [ListPortfolios](https://www.lusid.com/docs/api/lusid/endpoints/portfolios/ListPortfolios) API as Jane Smith whose login is `jane.smith@acme.com`, you might send the following request: ```shell curl -X GET "https://.lusid.com/api/api/portfolios?limit=3"  -H "X-LUSID-Run-As-Login: jane.smith@acme.com"  -H "Authorization: Bearer " ``` ### Impersonating one or more roles To impersonate one or more roles as a non-existent user in a request, you must include the following HTTP headers: - `X-LUSID-Run-As-User`, specifying the [user ID](/v1/docs/what-is-a-user-id-and-how-do-i-discover-one) of a user that does not exist in LUSID. LUSID will log activities as this user ID. > [!NOTE] > **Note** > > You can use any user ID value for non-existent impersonated users, however the value should not contain personally identifying information. - `X-LUSID-Run-As-Roles`, specifying a comma-separated list of roles that grant access to the requested features and data. > [!NOTE] > **Note** > > You must prefix roles that are not in the `default` scope with `<scope>:`. For example, the `lusid-administrator` role is in the scope `LUSID_SYSTEM`, therefore you must specify the value `LUSID_SYSTEM:lusid-administrator`. You can call the [ListRoles](https://www.lusid.com/docs/api/identity/endpoints/roles/ListRoles) API to view role scopes. For example, to call the [ListPortfolios](https://www.lusid.com/docs/api/lusid/endpoints/portfolios/ListPortfolios) API as an impersonating user with the granting roles `portfolio-manager-UK` and `portfolio-manager-US`, you might send the following request: ```shell curl -X GET "https://.lusid.com/api/api/portfolios?limit=3"  -H "X-LUSID-Run-As-User: my-impersonated-user"  -H "X-LUSID-Run-As-Roles: portfolio-manager-UK, portfolio-manager-US"  -H "Authorization: Bearer " ``` Note the following: - The specified roles must grant access to both the required data and feature policies for the request. [Read more.](/v1/docs/what-are-a-policy-and-a-policy-collection) - You must use the service user’s generated PAT as the bearer token for an impersonating call. - You cannot create or use an impersonated user’s PAT. You may only use the service user’s PAT. ## Viewing impersonated request logs When you make an impersonated request, the [request logs](/v1/docs/troubleshooting-a-failed-request-using-the-insights-service) contain the following values: - The `user` ID of the impersonated user. - The `impersonatingUser` ID. ![](https://cdn.document360.io/d575ad81-c0ed-4980-bbd1-d59ac5c3de82/Images/Documentation/image(503).png) > [!NOTE] > **Note** > > Currently, you can only retrieve the `impersonatingUser` ID via the Insights API, for example by calling the [GetRequestLog](https://www.lusid.com/docs/api/insights/endpoints/requests/GetRequestLog) endpoint. ## Troubleshooting ### 403 response when impersonating the `lusid-administrator` role When you use the `X-LUSID-Run-As-Roles` HTTP header, you must prefix roles that are not in the `default` scope with `<scope>:`. You can call the [ListRoles](https://www.lusid.com/docs/api/identity/endpoints/roles/ListRoles) API to view role scopes. [See Impersonating one or more roles.](/v1/docs/how-do-i-use-the-impersonation-feature#impersonating-one-or-more-roles)