Process UserInfo Request
This API gathers information about a user.
Path parameters
A service ID.
Request body
An access token.
Client certificate used in the TLS connection established between the client application and the userinfo endpoint.
The value of this request parameter is referred to when the access token given to the userinfo endpoint was bound to a client certificate when it was issued. See [OAuth 2.0 Mutual TLS Client Authentication and Certificate-Bound Access Tokens] (https://datatracker.ietf.org/doc/rfc8705/) for details about the specification of certificate-bound access tokens.
DPoP header presented by the client during the request to the user info endpoint.
The header contains a signed JWT which includes the public key that is paired with the private key used to sign the JWT. See OAuth 2.0 Demonstration of Proof-of-Possession at the Application Layer (DPoP) for details.
HTTP method of the user info request. This field is used to validate the DPoP header. In normal cases, the value is either GET or POST.
URL of the user info endpoint. This field is used to validate the DPoP header.
If this parameter is omitted, the userInfoEndpoint property of the service is used as the default value. See OAuth 2.0 Demonstration of Proof-of-Possession at the Application Layer (DPoP) for details.
The full URL of the userinfo endpoint.
The HTTP message body of the request, if present.
The target URI of the userinfo request, including the query part, if any.
The flag indicating whether to check if the DPoP proof JWT includes the expected nonce value.
If this request parameter is set to true or if the service's dpopNonceRequired property is set to true, the /auth/userinfo API checks if the DPoP proof JWT includes the expected nonce value. In this case, the response from the /auth/userinfo API will include the dpopNonce response parameter, which should be used as the value of the DPoP-Nonce HTTP header.
The flag indicating whether the userinfo request contains a request body.
Response
User info retrieved successfully
The code which represents the result of the API call.
A short message which explains the result of the API call.
The next action that the authorization server implementation should take.
The list of claims that the client application requests to be embedded in the ID token.
The ID of the client application which is associated with the access token.
The client ID alias when the authorization request for the access token was made.
The flag which indicates whether the client ID alias was used when the authorization request for the access token was made.
The content that the authorization server implementation can use as the value of WWW-Authenticate header on errors.
The scopes covered by the access token.
The subject (= resource owner's ID).
The access token that came along with the userinfo request.
The value of the userinfo property in the claims request parameter or in the claims property in an authorization request object.
the claims that the user has consented for the client application to know.
Get names of claims that are requested indirectly by "transformed claims". A client application can request "transformed claims" by adding names of transformed claims in the claims request parameter. The following is an example of the claims request parameter that requests a predefined transformed claim named 18_or_over and a transformed claim named nationality_usa to be embedded in the response from the userinfo endpoint.
{
"transformed_claims": {
"nationality_usa": {
"claim": "nationalities",
"fn": [
[ "eq", "USA" ],
"any"
]
}
},
"userinfo": {
"::18_or_over": null,
":nationality_usa": null
}
}
The example above assumes that a transformed claim named 18_or_over is predefined by the authorization server like below.
{
"18_or_over": {
"claim": "birthdate",
"fn": [
"years_ago",
[ "gte", 18 ]
]
}
}
In the example, the nationalities claim is requested indirectly by the nationality_usa transformed claim. Likewise, the birthdate claim is requested indirectly by the 18_or_over transformed claim. When the claims request parameter of an authorization request is like the example above, this requestedClaimsForTx property will hold the following value.
[ "birthdate", "nationalities" ]
It is expected that the authorization server implementation prepares values of the listed claims and passes them as the value of the claimsForTx request parameter when it calls the /api/auth/userinfo/issue API. The following is an example of the value of the claimsForTx request parameter.
{
"birthdate": "1970-01-23",
"nationalities": [ "DEU", "USA" ]
}
the value of the transformed_claims property in the claims request parameter of an authorization request or in the claims property in a request object.
The entity ID of the client.
Flag which indicates whether the entity ID of the client was used when the request for the access token was made.
The expected nonce value for DPoP proof JWT, which should be used as the value of the DPoP-Nonce HTTP header.
The location of the client's metadata document that was used to resolve client metadata.
This property is set when client metadata was retrieved via the OAuth Client ID Metadata Document (CIMD) mechanism.
Flag indicating whether a metadata document was used to resolve client metadata for this request.
When true, the client metadata was retrieved via the CIMD mechanism rather than from the Authlete database.