Open Staff View
POST/api/portal/auth/view-as
Trades the single-use code from a merchant's staff-view link for a read-only session token on the buyer. The code works once and expires 5 minutes after it was issued; the session lasts 30 minutes.
This endpoint currently requires session authentication; Personal Access Token scope support is in progress.
The response matches Log In, plus user.view_as (session_id, staff_name, expires_at), which is also present on Get Current Buyer for the whole session. While it is set, every request other than a read, Quote Prices and Log Out answers 403 with reason: staff_view_read_only; after the session ends or is revoked, requests answer 401 with reason: staff_view_ended. Log Out ends the staff view without affecting the buyer's own sessions.
A used, expired or unknown code returns 422.
Request
Responses
- 200
- 401
- 403
- 422
- 429
OK
Response Headers
Unauthenticated — the bearer token is missing, revoked, expired, or malformed. Never retry automatically; fix the credential. See the Errors guide.
Forbidden — the token lacks a required scope, the endpoint is not available to API tokens, or the user behind the token lacks the permission. A human must adjust the token scopes or user permissions; do not retry.
Unprocessable Entity
Response Headers
Rate limited — platform limit is 1,000 requests/min; individual tokens may carry lower limits. Honor the Retry-After header before retrying. See the Rate Limits guide.