v3
OpenAPI 3.1.02026-08-06274467602.9 KBauth
Inspect Setup Token
Report what an account-setup token is worth, without consuming it.
Rate Limited: 20 requests per minute per IP address — headroom for a mail gateway's link scanner plus the recipient's own page loads.
Does not require authentication; the token is the credential. Reading a token must never consume it: Microsoft Defender Safe Links fetches every URL in inbound mail before delivering it, so a consume-on-read token is spent by a scanner before the recipient ever opens the message.
post/api/v1/auth/setup-token/inspect
Request body
Response
Successful Response