User Impersonation using Web API

Question

How can I retrieve records behalf of another user.

Xrm.WebApi.retrieveMultipleRecords("account", "?$select=name&$top=3").then(
    function success(result) {
        for (var i = 0; i < result.entities.length; i++) {
            console.log(result.entities[i]);
        }                    
        // perform additional operations on retrieved records
    },
    function (error) {
        console.log(error.message);
        // handle error conditions
    }
);

Answer 1

I know we can do impersonation using XMLHttpRequest by passing MSCRMCallerID header. Not sure we can achieve the same in Xrm.WebApi.

This is my Prod code, doing some update/assign operation under Admin impersonation from a HTML webresource.

var entity = {};
entity["[email protected]"] = "/systemusers(" + currentUserId + ")";

var req = new XMLHttpRequest();
req.open("PATCH", parent.Xrm.Utility.getGlobalContext().getClientUrl() + "/api/data/v9.1/new_customentity(" + opptyid + ")", false);
req.setRequestHeader("OData-MaxVersion", "4.0");
req.setRequestHeader("OData-Version", "4.0");
req.setRequestHeader("Accept", "application/json");
req.setRequestHeader("Content-Type", "application/json; charset=utf-8");
req.setRequestHeader("MSCRMCallerID", "0AFB2F7E-D323-E511-80F0-C4346BAC29F0"); //CRM Admin impersoantion
req.onreadystatechange = function () {
    if (this.readyState === 4) {
        req.onreadystatechange = null;
        if (this.status === 204) {
            //Success - No Return Data - Do Something
        } else {
            //Xrm.Utility.alertDialog(this.statusText);
        }
    }
};
req.send(JSON.stringify(entity));

Update

Passing header is the only way and Xrm.WebApi cannot accept request headers.

Documentation says:

There are two ways you can impersonate a user, both of which are made possible by passing in a header with the corresponding user id.

Preferred: Impersonate a user based on their Azure Active Directory (AAD) object id by passing that value along with the header CallerObjectId.
Legacy: To impersonate a user based on their systemuserid you can leverage MSCRMCallerID with the corresponding guid value.