When doing server-to-server API integrations, you may want to make API calls on behalf of another user. In Higher Logic Vanilla (Vanilla), you can achieve this by spoofing another user. In this article, you'll learn how.
What API calls can you spoof?
You can spoof any APIv2 call you want, as long as the user you're spoofing has access to the endpoint.
Pitfalls of spoofing
Before you decide to use the spoofing functionality, make sure you understand the pitfalls.
- Spoofing is a very powerful tool, but can be dangerous too because you're allowing access to other user accounts. Make sure you really need to spoof.
- Only ever spoof with an access token on the server. Never pass spoof headers in the client with JavaScript, in a mobile app, etc.
- Don't use spoofing as a workaround for SSO. Think of spoofing as a tool for administrators or server integrations such as automated posts on behalf of users.
- When you spoof as another user, the call will be as that user. This is especially important when it comes to that user's permissions. In other words, you can only make API calls that the spoofed user can make, based on their permissions.
Enable API spoofing
API spoofing requires the Spoof addon to be enabled. You can enable it in the Dashboard, on the Settings > Addons > Addons page.
In order to spoof, you must make API calls with an access token that has admin access (Garden > Settings > Manage). Make sure you have an access token associated with a user that has the proper permissions.
Make spoof calls
In order to spoof when making an API call, you pass the user ID of the user you want to spoof in the X-Vanilla-Spoof header.
Example
Auhorization: Bearer <Access Token>
X-Vanilla-Spoof: 123
These headers will make the API call as user "123" rather than the user who owns the access token.
Spoofing With Smart IDs
The example above shows an integer user ID. While this works, it can sometimes be difficult to develop with because you have to look up users before spoofing as them. To get around this, you can use Vanilla's Smart IDs to spoof users by name, email address, or SSO ID.
Examples
// Spoof as username "frank"
X-Vanilla-Spoof: $name:frank
// Spoof with SAML SSOID
X-Vanilla-Spoof: $saml:f27d3aa9-23be-4bdf-9167-3a1f0c45cace
You can look up a user when spoofing with any valid smart ID. For more information on smart IDs, check out the Smart ID documentation.
