Sign in

v1

latestOpenAPI 3.0.0Apache 2.0 License2026-07-14117758.9 KB

Grants permission to inspect the metadata and state of an OAuth 2.0 access token or refresh token

Implements RFC 7662 OAuth 2.0 Token Introspection over a SigV4-authenticated endpoint. Inspects the metadata of an access_token or refresh_token issued by AWS Sign-In and returns the claims associated with it.

Inactive token semantics (RFC 7662 §2.2): when the supplied token is unknown, expired, revoked, malformed, or owned by a different account, the response body is exactly { "active": false } with all other claims omitted.

post/v1/introspect#x-amz-client-auth-method=iam

Query parameters

x-amz-client-auth-method'iam' required

Request body

tokenstring password required

Token string submitted for introspection. May be an AWS Sign-In access_token (prefix "ASOA") or refresh_token (prefix "ASOR").

token_type_hintstring
<p>Optional RFC 7662 §2.1 token_type_hint value. One of:</p> <ul> <li>&quot;access_token&quot;</li> <li>&quot;refresh_token&quot;</li> </ul>

Response

Success

activeboolean required

Indicates whether the token is currently active. <code>true</code> only when the token is valid, has not expired, has not been revoked, and belongs to the caller's account.

clientIdstring

Client identifier for the OAuth 2.0 client that requested the token.

userIdstring

User identifier matching sts:GetCallerIdentity's <code>UserId</code> field for the token's subject principal (e.g. "AIDAEXAMPLE" for an IAM user, or "AROAEXAMPLE:session-name" for an assumed role).

tokenTypestring

Indicates which kind of token was introspected. One of "access_token" or "refresh_token".

expinteger

Token expiration time as a NumericDate (Unix epoch seconds).

iatinteger

Token issuance time as a NumericDate (Unix epoch seconds).

nbfinteger

Token "not before" time as a NumericDate (Unix epoch seconds).

substring

Subject of the token: the IAM principal ARN. For assumed-role sessions, this is the session ARN (matches sts:GetCallerIdentity's <code>Arn</code> field), e.g. arn:aws:sts::123456789012:assumed-role/MyRole/session-name.

audstring

Audience of the token: the OAuth resource the token is scoped to (for example, "aws-mcp.amazonaws.com"). Omitted for refresh tokens.

issstring

Issuer of the token. Always "signin.amazonaws.com" for AWS Sign-In.

jtistring

Unique identifier for the token.

accountIdstring

12-digit AWS account ID of the token's subject principal.

signinSessionstring

AWS Sign-In session ARN bound to the token, of the form arn:aws:signin:{region}:{account}:session/{uuid}.

resourcestring

The OAuth resource the token is scoped to during Human OAuth flow. Only present for refresh token introspection.