# User Impersonation - ‘x-impersonate-uuid' usage **URL:** \ **Category:** API & SDK\ **Created:** [September 12, 2025, 1:58am UTC](https://community.servicem8.com/t/user-impersonation-x-impersonate-uuid-usage/36 "2025-09-12T01:58:37Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![developer](https://avatars.discourse-cdn.com/v4/letter/d/bcef8e/32.png) [@developer](https://community.servicem8.com/u/developer)\ **Post date:** [September 12, 2025, 1:58am UTC](https://community.servicem8.com/t/user-impersonation-x-impersonate-uuid-usage/36/1 "2025-09-12T01:58:37Z")
**Originally posted by Anthony Rogers** I would like to know more about how to use User Impersonation I need to mark jobs as completed by a specific staff member. The following does not appear to work ```curl curl -X POST "https://api.servicem8.com/api_1.0/job/JOB_UUID_HERE.json" ^ -H "X-Api-Key: API-KEY-HERE" ^ -H "x-impersonate-uuid: STAFF_UUID_HERE" ^ -H "accept: application/json" ^ -H "content-type: application/json" ^ -d "{ \"completion_date\": \"2025-09-12 12:00:00\", \"status\": \"Completed\" }" ``` Please provide a working curl example of an API POST to job/{uuid}.json to complete a job as a specific staff Cheers ---
**Author:** ![chris\_pianto](https://avatars.discourse-cdn.com/v4/letter/c/d2c977/32.png) [@chris\_pianto](https://community.servicem8.com/u/chris_pianto)\ **Post date:** [May 26, 2026, 9:16am UTC](https://community.servicem8.com/t/user-impersonation-x-impersonate-uuid-usage/36/2 "2026-05-26T09:16:28Z")
I’m having the same issue. When I use OAuth, the x-impersonate-uuid header works. But when I use the api key, it doesn’t work. Is this intentional? ---
**Author:** ![Cody](https://sea2.discourse-cdn.com/flex002/user_avatar/community.servicem8.com/cody/32/52_2.png) [@Cody](https://community.servicem8.com/u/Cody)\ **Post date:** [May 29, 2026, 9:18am UTC](https://community.servicem8.com/t/user-impersonation-x-impersonate-uuid-usage/36/3 "2026-05-29T09:18:10Z")
Hi Chris, User impersonation is done by including an `x-impersonate-uuid` header on the API request, and the value needs to be an active staff UUID in the same ServiceM8 account. To complete a job via the API, you can `POST` to `/job/{uuid}.json` (this endpoint supports both API key and OAuth authentication). Here’s a working cURL example (API key + impersonation) that sets the job `status` to `Completed` and sets `completion_date`: ```bash curl -X POST "https://api.servicem8.com/api_1.0/job/JOB_UUID_HERE.json" \ -H "X-Api-Key: API_KEY_HERE" \ -H "x-impersonate-uuid: STAFF_UUID_HERE" \ -H "Content-Type: application/json" \ -d '{ "status": "Completed", "completion_date": "2026-05-26 12:00:00" }' ``` To confirm who ServiceM8 recorded as completing the job, retrieve the job and check `completion_actioned_by_uuid`. If the impersonated UUID isn’t valid/active for that account, the API can return a 403. If you’re still seeing OAuth succeed but API key not apply the impersonation header, email [support@servicem8.com](mailto:support@servicem8.com) with the response body you’re getting (and the request headers, with the API key removed) so we can verify what’s happening. Thanks, Cody ---
**Author:** ![chris\_pianto](https://avatars.discourse-cdn.com/v4/letter/c/d2c977/32.png) [@chris\_pianto](https://community.servicem8.com/u/chris_pianto)\ **Post date:** [June 2, 2026, 11:40pm UTC](https://community.servicem8.com/t/user-impersonation-x-impersonate-uuid-usage/36/4 "2026-06-02T23:40:19Z")
Hi Cody. As you requested, I emailed the support email. Their response was to tell me to ask my question on this community forum. I explained that I was referred to that email by you, and they haven’t responded. Where do I go from here? I feel like I’m in a loop ---
**Author:** ![Cody](https://sea2.discourse-cdn.com/flex002/user_avatar/community.servicem8.com/cody/32/52_2.png) [@Cody](https://community.servicem8.com/u/Cody)\ **Post date:** [June 6, 2026, 12:00am UTC](https://community.servicem8.com/t/user-impersonation-x-impersonate-uuid-usage/36/5 "2026-06-06T00:00:31Z")
Hi Chris, Sorry you’ve been bounced around. User Impersonation is supported when you authenticate via OAuth 2.0 (Public Application). To impersonate a staff member, set the `x-impersonate-uuid` header on the request, and the value must be an active, valid staff UUID for the current account. To mark a job as completed via the API, `POST` to `/job/{uuid}.json` with `status` set to `Completed` (the `status` field is required), and you can also set `completion_date`. If you’re using OAuth for this endpoint, it requires the `manage_jobs` scope. You can authenticate by supplying the access token prefixed with `Bearer ` on the HTTP `Authorization` header. ```bash curl -X POST "https://api.servicem8.com/api_1.0/job/JOB_UUID_HERE.json" \ -H "Authorization: Bearer ACCESS_TOKEN_HERE" \ -H "x-impersonate-uuid: STAFF_UUID_HERE" \ -H "Content-Type: application/json" \ -d '{ "status": "Completed", "completion_date": "2026-06-02 12:00:00" }' ``` Thanks, Cody ---
**Author:** ![chris\_pianto](https://avatars.discourse-cdn.com/v4/letter/c/d2c977/32.png) [@chris\_pianto](https://community.servicem8.com/u/chris_pianto)\ **Post date:** [June 6, 2026, 7:21am UTC](https://community.servicem8.com/t/user-impersonation-x-impersonate-uuid-usage/36/6 "2026-06-06T07:21:05Z")
Hi Cody. Does the x-impersonate-uuid header work when using API Key authentication? ---
**Author:** ![Cody](https://sea2.discourse-cdn.com/flex002/user_avatar/community.servicem8.com/cody/32/52_2.png) [@Cody](https://community.servicem8.com/u/Cody)\ **Post date:** [June 8, 2026, 8:42am UTC](https://community.servicem8.com/t/user-impersonation-x-impersonate-uuid-usage/36/7 "2026-06-08T08:42:57Z")
Hi Chris, Sorry, I got this wrong in my earlier reply. I initially thought `x-impersonate-uuid` was supported with API key authentication, but after checking this properly, it is only supported when authenticating with OAuth 2.0. So the direct answer is: no, `x-impersonate-uuid` does not work with API key authentication. To impersonate a staff member, use OAuth and pass the access token in the `Authorization` header. The impersonated UUID must be an active staff UUID in the same account. ```bash curl -X POST "https://api.servicem8.com/api_1.0/job/JOB_UUID_HERE.json" \ -H "Authorization: Bearer ACCESS_TOKEN_HERE" \ -H "x-impersonate-uuid: STAFF_UUID_HERE" \ -H "Content-Type: application/json" \ -d '{ "status": "Completed", "completion_date": "2026-06-02 12:00:00" }' ``` For this endpoint, the OAuth app needs the `manage_jobs` scope. Sorry again for the confusion and for sending you down the wrong path. Thanks, Cody ---
**Author:** ![Cody](https://sea2.discourse-cdn.com/flex002/user_avatar/community.servicem8.com/cody/32/52_2.png) [@Cody](https://community.servicem8.com/u/Cody)\ **Post date:** [June 9, 2026, 7:22am UTC](https://community.servicem8.com/t/user-impersonation-x-impersonate-uuid-usage/36/8 "2026-06-09T07:22:45Z")
Hi Chris, Yes, you can use the `x-impersonate-uuid` header on API requests, and that includes requests authenticated with an API key. User impersonation is done by adding the `x-impersonate-uuid` header to your API request, and the value must be an active staff UUID in the same account. The Job update endpoint (`POST /job/{uuid}.json`) supports API key authentication (header `X-Api-Key`) as well as OAuth. If the impersonation UUID isn’t valid/active, you’ll typically see a `403 Forbidden` response. To mark a job completed via `POST /job/{uuid}.json`, `status` is required (valid values include `Completed`) and you can also set `completion_date`. Also, `completion_actioned_by_uuid` is a read-only field on the Job record, so impersonation is the mechanism that controls who ServiceM8 records as having completed it. If you’re still seeing OAuth work but API key not apply the impersonation, reply here with the HTTP status code and response body you’re getting (with credentials removed) so we can pinpoint what’s happening. Thanks, Cody