Process Introspection Request
This API gathers information about an access token.
Path parameters
A service ID.
Request body
An access token to introspect.
A string array listing names of scopes which the caller (= a protected resource endpoint of the service) requires. When the content type of the request from the service is application/x-www-form-urlencoded, the format of scopes is a space-separated list of scope names.
If this parameter is a non-empty array and if it contains a scope which is not covered by the access token,action=FORBIDDEN with error=insufficient_scope is returned from Authlete.
A subject (= a user account managed by the service) whom the caller (= a protected resource endpoint of the service) requires.
If this parameter is not null and if the value does not match the subject who is associated with the access token, action=FORBIDDEN with error=invalid_request is returned from Authlete.
Client certificate in PEM format, used to validate binding against access tokens using the TLS client certificate confirmation method.
DPoP header presented by the client during the request to the resource server.
The header contains a signed JWT which includes the public key that is paired with the private key used to sign the JWT. See OAuth 2.0 Demonstration of Proof-of-Possession at the Application Layer (DPoP) for details.
HTTP method of the request from the client to the protected resource endpoint. This field is used to validate the DPoP header.
See OAuth 2.0 Demonstration of Proof-of-Possession at the Application Layer (DPoP) for details.
URL of the protected resource endpoint. This field is used to validate the DPoP header.
See OAuth 2.0 Demonstration of Proof-of-Possession at the Application Layer (DPoP) for details.
The resources specified by the resource request parameters in the token request. See "Resource Indicators for OAuth 2.0" for details.
Authentication Context Class Reference values one of which the user authentication performed during the course of issuing the access token must satisfy.
The maximum authentication age which is the maximum allowable elapsed time since the user authentication was performed during the course of issuing the access token.
HTTP Message Components required to be in the signature. If absent, defaults to [ "@method", "@target-uri", "authorization" ].
The full URL of the userinfo endpoint.
The HTTP message body of the request, if present.
The target URI of the resource request, including the query part, if any.
The flag indicating whether to check if the DPoP proof JWT includes the expected nonce value.
If this request parameter is set to true or if the service's dpopNonceRequired property is set to true, the /auth/introspection API checks if the DPoP proof JWT includes the expected nonce value. In this case, the response from the /auth/introspection API will include the dpopNonce response parameter, which should be used as the value of the DPoP-Nonce HTTP header.
The flag indicating whether the resource request contains a request body.
When the resource request must comply with the HTTP message signing requirements defined in the FAPI 2.0 Message Signing specification, the "content-digest" component identifier must be included in the signature base of the HTTP message signature (see RFC 9421 HTTP Message Signatures) if the resource request contains a request body.
When this requestBodyContained parameter is set to true, Authlete checks whether "content-digest" is included in the signature base, if the FAPI profile applies to the resource request.
Response
The code which represents the result of the API call.
A short message which explains the result of the API call.
The next action that the authorization server implementation should take.
The content that the authorization server implementation can use as the value of WWW-Authenticate header on errors.
The client ID.
The client ID alias when the token request was made. If the client did not have an alias, this parameter is null. Also, if the token request was invalid and it failed to identify a client, this parameter is null.
The flag which indicates whether the client ID alias was used when the token request was made. true if the client ID alias was used when the token request was made.
The time at which the access token expires. The value is represented in milliseconds since the Unix epoch (1970-01-01).
The subject who is associated with the access token. The value of this property is null if the access token was issued using the flow of Client Credentials Grant.
The scopes covered by the access token.
true if the access token exists.
true` if the access token is usable (= exists and has not expired).
true if the access token exists.
true if the access token can be refreshed using the associated refresh token which had been issued along with the access token. false if the refresh token for the access token has expired or the access token has no associated refresh token.
The client certificate thumbprint used to validate the access token.
The target resources. This represents the resources specified by the resource request parameters or by the resource property in the request object.
See "Resource Indicators for OAuth 2.0" for details.
The target resources this proeprty holds may be the same as or different from the ones resource property holds.
The value of the grant_id request parameter of the device authorization request.
The grant_id request parameter is defined in Grant Management for OAuth 2.0 , which is supported by Authlete 2.3 and newer versions.
the flag which indicates whether the access token is for an external attachment.
the claims that the user has consented for the client application to know.
The grant type of the access token when the access token was created.
The Authentication Context Class Reference of the user authentication that the authorization server performed during the course of issuing the access token.
The time when the user authentication was performed during the course of issuing the access token.
The entity ID of the client.
Flag which indicates whether the entity ID of the client was used when the request for the access token was made.
The flag indicating whether the token is for credential issuance.
The c_nonce
The time at which the c_nonce expires.
The credentials that can be obtained by presenting the access token.
The expected nonce value for DPoP proof JWT, which should be used as the value of the DPoP-Nonce HTTP header.
The flag indicating whether the HTTP response from the protected resource endpoint must include an HTTP message signature (RFC 9421 HTTP Message Signatures) in compliance with FAPI 2.0 Message Signing.
When this response parameter is true, the HTTP response from the protected resource endpoint must include the Signature and Signature-Input HTTP fields.
The location of the client's metadata document that was used to resolve client metadata.
This property is set when client metadata was retrieved via the OAuth Client ID Metadata Document (CIMD) mechanism.
Flag indicating whether a metadata document was used to resolve client metadata for this request.
When true, the client metadata was retrieved via the CIMD mechanism rather than from the Authlete database.