Run an operator action as a merchant (audit-logged)

POST/operator/act-on-behalf

Authorization

AuthorizationBearer token (JWT) · headerrequired

JWT issued by the external IdP via the OAuth 2.0 authorization-code flow (Kinde in production; a simulator in test). The client obtains it and sends it as a Bearer token on every authenticated call. Sarvex's services verify it — issuer, audience, signature (IdP JWKS), expiry — and read identity and tenant from its claims. Sarvex does not issue or revoke these tokens. merchant_id/store_id are read from the verified claims (and the merchant→store mapping), never from the URL. The operator scope is required for /operator/*. Operators acting on a specific merchant pass the X-Operate-As header, which is recorded in the audit log.

Scopes:operator

Header parameters

X-Operate-Asstringrequired

Merchant id the action is performed for.

Request body

requiredapplication/json

actionstringrequired

paramsobject

Responses

200

Executed.

statusstring

actionstring

targetstring

messagestring

400

X-Operate-As missing.

errorobjectrequired

Show properties

codestringrequired

messagestringrequired

detailsobject | null

403

Authenticated but not permitted (e.g. non-operator on an operator route).

errorobjectrequired

Show properties

codestringrequired

messagestringrequired

detailsobject | null

422

Request body failed validation.

errorobjectrequired

Show properties

codestringrequired

messagestringrequired

detailsobject | null

Try it

Server

Base URLCustom base URLOverrides the selected server when set.

Authorization

Bearer token (JWT)Remember on this deviceInclude my values in samples

Parameters

X-Operate-Asheader*Merchant id the action is performed for.

Bodyapplication/json

Request body

Request

curl -X POST "https://api.sarvex.example.com/v1/operator/act-on-behalf" \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "X-Operate-As: string" \
  -H "Content-Type: application/json" \
  -d '{
  "action": "string",
  "params": {}
}'

const response = await fetch("https://api.sarvex.example.com/v1/operator/act-on-behalf", {
  method: "POST",
  headers: {
    "Authorization": "Bearer YOUR_TOKEN",
    "X-Operate-As": "string",
    "Content-Type": "application/json"
  },
  body: "{\n  \"action\": \"string\",\n  \"params\": {}\n}"
});

import requests

response = requests.post(
    "https://api.sarvex.example.com/v1/operator/act-on-behalf",
    headers={
        "Authorization": "Bearer YOUR_TOKEN",
        "X-Operate-As": "string",
        "Content-Type": "application/json"
    },
    data="{\n  \"action\": \"string\",\n  \"params\": {}\n}",
)

Response

{
  "status": "success",
  "action": "string",
  "target": "string",
  "message": "string"
}

{
  "error": {
    "code": "string",
    "message": "string",
    "details": {}
  }
}

{
  "error": {
    "code": "string",
    "message": "string",
    "details": {}
  }
}

{
  "error": {
    "code": "string",
    "message": "string",
    "details": {}
  }
}