---
title: "Use this endpoint to retrieve token metadata"
method: POST
path: "/introspect"
tags: ["Introspection Endpoint"]
---

# Use this endpoint to retrieve token metadata

`POST /introspect`

Query the authorization server to determine the set of metadata for a given token.
This metadata includes whether or not the token is currently active (or if it has 
expired or otherwise been revoked), what rights of access the token carries (usually
conveyed through OAuth 2.0 scopes), and the authorization context in which the token
was granted (including who authorized the token and which client it was issued to).

## Headers

- `x-client-certificate` string

## Response `200`

Metadata associated with the given token.

- IntrospectResponse — introspect metadata response
  - `active` boolean, required — Boolean indicator of whether or not the presented token is currently active.
  - `scope` string — Space-delimited string containing the scopes associated with this token.
  - `client_id` string — Client identifier that requested this token.
  - `username` string — Human-readable identifier for the resource owner who authorized this token.
  - `token_type` 'Bearer' — Type of the token
  - `grant_id` string — Unique identifier of an authorization grant
  - `exp` integer — Integer timestamp, measured in the number of seconds since January 1 1970 UTC, indicating when this token will expire
  - `iat` integer — Integer timestamp, measured in the number of seconds since January 1 1970 UTC, indicating when this token was originally issued
  - `nbf` integer — Integer timestamp, measured in the number of seconds since January 1 1970 UTC, indicating when this token is not to be used before
  - `sub` string — Subject of the token. Usually a machine-readable identifier of the resource owner who authorized this token.
  - `aud` object — Service-specific string identifier or list of string identifiers representing the intended audience for this token
  - `iss` string — String representing the issuer of this token
  - `jti` string — String identifier for the token

---

[API](https://skmtc.net/ibm/apis/ibm-security-verify-access-oidc-provider.md) · [All operations](https://skmtc.net/ibm/apis/ibm-security-verify-access-oidc-provider/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/ibm/ibm-security-verify-access-oidc-provider/versions/68cfc4d21b73/schema)