Process OAuth 2.0 Introspection Request
This API exists to help your authorization server provide its own introspection API which complies with RFC 7662 (OAuth 2.0 Token Introspection).
Path parameters
A service ID.
Request body
Request parameters which comply with the introspection request defined in "2.1. Introspection Request" in RFC 7662.
The implementation of the introspection endpoint of your authorization server will receive an HTTP POST [RFC 7231] request with parameters in the application/x-www-form-urlencoded format. It is the entity body of the request that Authlete's /api/auth/introspection/standard API expects as the value of parameters.
Flag indicating whether to include hidden properties in the output.
Authlete has a mechanism whereby to associate arbitrary key-value pairs with an access token. Each key-value pair has a hidden attribute. By default, key-value pairs whose hidden attribute is set to true are not embedded in the standard introspection output.
If the withHiddenProperties request parameter is given and its value is true, `/api/auth/introspection/standard API includes all the associated key-value pairs into the output regardless of the value of the hidden attribute.
The URI of the resource server making the introspection request.
If the rsUri request parameter is given and the token has audience values, Authlete checks if the value of the rsUri request parameter is contained in the audience values. If not contained, Authlete generates an introspection response with the active property set to false.
The rsUri request parameter is required when the resource server requests a JWT introspection response, i.e., when the value of the httpAcceptHeader request parameter is set to "application/token-introspection+jwt".
The value of the HTTP Accept header in the introspection request.
If the value of the httpAcceptHeader request parameter is "application/token-introspection+jwt", Authlete generates a JWT introspection response. See "4. Requesting a JWT Response" of "RFC 9701: JWT Response for OAuth Token Introspection" for more details.
The JWS alg algorithm for signing the introspection response. This parameter corresponds to introspection_signed_response_alg defined in "6. Client Metadata" of "RFC 9701: JWT Response for OAuth Token Introspection".
The default value is RS256.
The JWE alg algorithm for encrypting the introspection response. This parameter corresponds to introspection_encrypted_response_alg defined in "6. Client Metadata" of "RFC 9701: JWT Response for OAuth Token Introspection".
If the introspectionEncryptionAlg request parameter is specified, Authlete generates a JWT introspection response encrypted with the algorithm by this property and the algorithm specified by the introspectionEncryptionEnc request parameter.
The JWE enc algorithm for encrypting the introspection response. This parameter corresponds to introspection_encrypted_response_enc defined in "6. Client Metadata" of "RFC 9701: JWT Response for OAuth Token Introspection".
The default value is A128CBC_HS256.
The shared key for signing the introspection response with a symmetric algorithm.
The sharedKeyForSign request parameter is required when the introspection response is requested to be signed with a symmetric algorithm.
The shared key for encrypting the introspection response with a symmetric algorithm.
The sharedKeyForEncryption request parameter is required when the introspection response is requested to be encrypted with a symmetric algorithm.
The public key for signing the introspection response with an asymmetric algorithm.
The publicKeyForEncryption request parameter is required when the introspection response is requested to be encrypted with an asymmetric algorithm.
Response
Token introspection completed successfully
The code which represents the result of the API call.
A short message which explains the result of the API call.
The next action that the authorization server implementation should take.
The content that the authorization server implementation is to return to the client application.