> ## Documentation Index
> Fetch the complete documentation index at: https://docs.truthlocks.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Support access sessions

> How Truthlocks customer support accesses your tenant with time-limited, scoped impersonation sessions.

When you contact Truthlocks support and troubleshooting requires access to your tenant, support staff use **impersonation sessions** — time-limited, scope-restricted sessions that are fully recorded in your audit log.

## How it works

<Steps>
  <Step title="Support creates a session">
    A support staff member creates an impersonation session specifying your
    tenant, the required permission scopes, a TTL, and a reason for access.
    Sessions can optionally be scoped to a specific organization within your
    tenant.
  </Step>

  <Step title="Session is time-limited">
    Every session has a configurable time-to-live (TTL) between 1 and 60
    minutes (defaults to 15 minutes). When the TTL expires, access is revoked
    immediately — no manual action required.
  </Step>

  <Step title="Actions are recorded">
    Every HTTP request the support staff member makes during the session is
    recorded in a dedicated access log with the method, path, status code,
    and request ID. These events also appear in your tenant's
    [audit log](/security/audit).
  </Step>
</Steps>

## Session properties

| Property         | Description                                                                                                              |
| :--------------- | :----------------------------------------------------------------------------------------------------------------------- |
| **Tenant**       | The tenant the session grants access to.                                                                                 |
| **Organization** | *(optional)* A specific organization within the tenant. When set, access is restricted to that organization's data only. |
| **Scopes**       | The permissions granted for the session. Defaults to `read_only` if none are specified.                                  |
| **TTL**          | Time-to-live in minutes (1–60, defaults to 15).                                                                          |
| **Reason**       | A human-readable explanation of why the session was created (minimum 10 characters).                                     |
| **Status**       | `ACTIVE` (in use), `EXPIRED` (TTL reached), or `REVOKED` (manually ended).                                               |
| **IP address**   | The IP address of the support staff member who created the session.                                                      |
| **User-Agent**   | The browser or client used by support staff.                                                                             |
| **Issued at**    | When the session was created.                                                                                            |
| **Expires at**   | When the session automatically expires, based on the TTL.                                                                |

## Session lifecycle

* **Active** — the session is in use and the support staff member has access to the granted scopes.
* **Expired** — the TTL has been reached and access is automatically revoked.
* **Revoked** — a platform administrator ended the session early. The administrator's identity and an optional revocation reason are recorded.

## Reviewing support activity

### Audit log

All support session activity appears in your tenant's [audit log](/security/audit). Filter by the `support_session` event category to see exactly what was accessed and when.

```bash theme={null}
curl "https://api.truthlocks.com/v1/audit?category=support_session" \
  -H "X-API-Key: tl_live_..."
```

Each audit event includes the session ID, the staff member's identity, the action performed, and a timestamp.

### Per-session access logs

You can also retrieve a detailed access log for a specific session. Each entry records the HTTP method, request path, response status code, and a unique request ID.

```bash theme={null}
curl "https://api.truthlocks.com/v1/platform/support/sessions/{session_id}/access-logs" \
  -H "X-API-Key: tl_live_..."
```

```json theme={null}
[
  {
    "method": "GET",
    "path": "/v1/attestations",
    "status_code": 200,
    "request_id": "req_abc123",
    "timestamp": "2026-03-26T14:30:00Z"
  }
]
```

## Security guarantees

<CardGroup cols={2}>
  <Card title="Scoped access" icon="lock">
    Sessions are restricted to specific permission scopes and, optionally, a
    single organization. Support cannot access resources outside the granted
    scopes.
  </Card>

  <Card title="Time-limited" icon="clock">
    Every session expires automatically based on its TTL (1–60 minutes).
    There are no permanent support access grants.
  </Card>

  <Card title="Full audit trail" icon="list-check">
    Every HTTP request is recorded in the session's access log with the
    staff member's IP address and User-Agent.
  </Card>

  <Card title="Revocable" icon="ban">
    Active sessions can be revoked at any time by a platform administrator,
    with an optional reason.
  </Card>
</CardGroup>

## Related

<CardGroup cols={2}>
  <Card title="Audit logs" icon="scroll" href="/security/audit">
    View and export your tenant's audit events.
  </Card>

  <Card title="RBAC" icon="users" href="/security/rbac">
    Understand roles and permission scopes.
  </Card>
</CardGroup>