Mint a login token that lets the caller act as another user or a company's owner. Partners (bundle_id=1) may impersonate users/owners of their child companies; accounts (bundle_id=3) may impersonate users of their parent partner. Every attempt (grant + denial) is audited (AUTH_IMPERSONATE). Provide exactly one of user_id or company_id.

Auth

• Partner or account — collection bearer token. Scope; unauthorized targets return 403.

Rate limit

• No rate limit.

Body

Behaviour

• 200 returns a full login payload for the impersonated identity (token, login_type=impersonate, user, company, theme_options, white_label).
• 403 when the target is not within the caller's permitted tree.
• 404 when the user/company/owner cannot be found; 422 when neither id is supplied.