Identify

Identify the current access token, the workspace it is linked to, and any permissions it has.

Every kind of Attio access token can be introspected:

• Workspace access tokens, created from a workspace's settings. These have no OAuth client, so client_id and aud contain the workspace access token's own ID.
• OAuth access tokens, granted to an app through the OAuth 2.0 authorization code flow. client_id and aud contain the app ID.
• App access tokens, issued to an app installation and exposed to that app's server functions as ATTIO_API_TOKEN. client_id and aud contain the app ID.

Per RFC 7662, active is the only member guaranteed to be present. exp is always null, because Attio access tokens do not currently expire. All other members are optional, and are omitted rather than returned as null when they are not present.

Unknown, revoked, and deleted tokens are not treated as an error. They return 200 with {"active": false} and no other members.