Authenticating APIv2 calls as another user - Spoofing - Vanilla Success
<main> <article class="userContent"> <p>Sometimes when doing server to server API integrations you may want to make API calls on behalf of another user. This article articles explains the process.</p><h2 data-id="what-api-calls-can-you-spoof">What API Calls Can You Spoof?</h2><p>You can spoof any APIv2 call you want as long as the user you are spoofing has access to the endpoint.</p><h2 data-id="pitfalls-of-spoofing">Pitfalls of Spoofing</h2><p>Before you decide to use the spoofing functionality make sure you understand the pitfalls.</p><ol><li>Spoofing is a very powerful tool, but can be dangerous too because you are allowing access to other user accounts. Make sure you really need to spoof.</li><li>Only every spoof with an access token on the server. Never pass spoof headers in the client with javascript, in a mobile app, etc.</li><li>Don't use spoofing as a workaround for SSO. Think of spoofing as a tool for administrators or server integrations such as automated posts on behalf of users.</li><li>When you spoof as another user then the call will be made completely in the context of that user. This includes permissions. You can only make API calls that the spoofed user could also make.</li></ol><h2 data-id="enabling-api-spoofing">Enabling API Spoofing</h2><p>API Spoofing requires the <strong>Spoof</strong> addon to be enabled. You can enable it in your dashboard under addons. In order to spoof you will need to make API calls with an access token that has admin access (garden.settings.manage). Make sure you have an access token associated with a user that has enough permissions.</p><h2 data-id="making-spoof-calls">Making Spoof Calls</h2><p>In order to spoof when making an API call you pass the user ID of the user you want to spoof in the <code class="code codeInline" spellcheck="false" tabindex="0">X-Vanilla-Spoof</code> header. Here is an example:</p><pre class="code codeBlock" spellcheck="false" tabindex="0">Auhorization: Bearer <Access Token> X-Vanilla-Spoof: 123 </pre><p>These headers will make the API call as user "123" rather than the user that owns the access token.</p><h2 data-id="spoofing-with-smart-ids">Spoofing With Smart IDs</h2><p>The example above shows an integer user ID. This works, but can sometimes be difficult to develop with because you have to look up users before spoofing as them. To get around having to look up users you can use Vanilla's <a href="https://success.vanillaforums.com/kb/articles/46-smart-ids" rel="nofollow noreferrer ugc">smart IDs</a> to spoof users by name, email address, or SSO ID. Here are some examples:</p><pre class="code codeBlock" spellcheck="false" tabindex="0">// Spoof as username "frank" X-Vanilla-Spoof: $name:frank // Spoof with SAML SSOID X-Vanilla-Spoof: $saml:f27d3aa9-23be-4bdf-9167-3a1f0c45cace </pre><p>You can look up a user when spoofing with any valid smart ID. For more information on smart IDs check out the <a href="https://success.vanillaforums.com/kb/articles/46-smart-ids" rel="nofollow noreferrer ugc">Smart ID documentation</a>.</p> </article> </main>