---
title: "Copy of Generate token"
method: POST
path: "/introspect"
---

# Copy of Generate token

`POST /introspect`

## Response `200`

200

- object
  - `active` boolean, required — Whether the token is currently valid. false when the token cannot be found, has expired, has been revoked, is bound to a different client, or belongs to a user or organization that has been disabled.
  - `scope` string — Space-separated list of OAuth 2.0 scopes granted to this token. For access tokens, reflects the scopes encoded in the JWT at issuance. For refresh tokens, reflects the scopes stored in the token record at the time of authorization.
  - `client_id` string — The public key of the client application this token was issued to. Can be used to verify which integration or application authorized the token.
  - `sub` string — The subject of the token — identifies the user on whose behalf the token was issued. For user-authorized tokens (authorization code and refresh token grants), this is the user's ID. For service account tokens (client credentials grant), this is the ID of the organization owner associated with the client application.
  - `iss` string — The issuer of the token. Identifies the authorization server that minted this token. Always set to the auth domain (e.g. https://auth.greenhouse.io).
  - `iat` integer — The time at which the token was issued.
  - `exp` integer — The time at which the token expires. Tokens past this time will return active: false.
  - `jti` string — A unique identifier for this specific token instance. Can be used to correlate introspection responses with token issuance records.
  - `token_type` string — The token type. Always "bearer". Not present in refresh token responses.
  - `username` string — The email address of the user associated with the token. null if the user record cannot be resolved. Not present in refresh token responses.
  - `nbf` integer — The earliest time at which the token is considered valid ("not before"). Set to the same value as iat. Not present in refresh token responses.
  - `aud` string — The intended audiences of the token — the resource servers this token is valid for (e.g. ["https://harvest.greenhouse.io"]). Not present in refresh token responses.
  - `https://auth.greenhouse.io/claims` object
    - `silo` integer — The numeric ID of the silo that issued this token. Used to route requests to the correct silo when operating in a multi-silo environment.
    - `organization` object — The organization associated with the token's subject.
      - `id` integer — Internal organization ID.
      - `name` string — Display name of the organization.
    - `partner` object — The partner associated with the client application that requested the token. Always present — when the client has no partner association, id and name are null.
      - `id` string — Internal partner ID. null if the client application is not associated with a partner.
      - `name` string — Display name of the partner. null if the client application is not associated with a partner.
    - `user_role` 'basic' | 'job_admin' | 'site_admin' — The role of the authenticated user at the time of introspection. null if the user cannot be resolved. Because this reflects the user's current role rather than the role at token issuance, it may differ from what was present when the access token was originally minted. Not present in refresh token responses — use the access token introspection response for current role information.
    - `allowed_ips` string[] — The IP addresses permitted to use this token. An empty array indicates no IP restriction is applied. Not present in refresh token responses.

---

[API](https://skmtc.net/greenhouse/apis/auth-api.md) · [All operations](https://skmtc.net/greenhouse/apis/auth-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/greenhouse/auth-api/versions/9517a2e54640/schema)