---
title: "Introspect OAuth2 Access and Refresh Tokens"
method: POST
path: "/admin/oauth2/introspect"
tags: ["oAuth2"]
---

# Introspect OAuth2 Access and Refresh Tokens

`POST /admin/oauth2/introspect`

The introspection endpoint allows to check if a token (both refresh and access) is active or not. An active token
is neither expired nor revoked. If a token is active, additional information on the token will be included. You can
set additional data for a token by setting `session.access_token` during the consent flow.

## Response `200`

introspectedOAuth2Token

- IntrospectedOAuth2Token — Introspection contains an access token's session data as specified by [IETF RFC 7662](https://tools.ietf.org/html/rfc7662)
  - `active` boolean, required — Active is a boolean indicator of whether or not the presented token is currently active. The specifics of a token's "active" state will vary depending on the implementation of the authorization server and the information it keeps about its tokens, but a "true" value return for the "active" property will generally indicate that a given token has been issued by this authorization server, has not been revoked by the resource owner, and is within its given time window of validity (e.g., after its issuance time and before its expiration time).
  - `aud` string[] — Audience contains a list of the token's intended audiences.
  - `client_id` string — ID is a client identifier for the OAuth 2.0 client that requested this token.
  - `exp` integer — Expires at is an integer timestamp, measured in the number of seconds since January 1 1970 UTC, indicating when this token will expire.
  - `ext` object — Extra is arbitrary data set by the session.
  - `iat` integer — Issued at is an integer timestamp, measured in the number of seconds since January 1 1970 UTC, indicating when this token was originally issued.
  - `iss` string — IssuerURL is a string representing the issuer of this token
  - `nbf` integer — NotBefore is an integer timestamp, measured in the number of seconds since January 1 1970 UTC, indicating when this token is not to be used before.
  - `obfuscated_subject` string — ObfuscatedSubject is set when the subject identifier algorithm was set to "pairwise" during authorization. It is the `sub` value of the ID Token that was issued.
  - `scope` string — Scope is a JSON string containing a space-separated list of scopes associated with this token.
  - `sub` string — Subject of the token, as defined in JWT [RFC7519]. Usually a machine-readable identifier of the resource owner who authorized this token.
  - `token_type` string — TokenType is the introspected token's type, typically `Bearer`.
  - `token_use` string — TokenUse is the introspected token's use, for example `access_token` or `refresh_token`.
  - `username` string — Username is a human-readable identifier for the resource owner who authorized this token.

## Other responses

- `default` — errorOAuth2

---

[API](https://skmtc.net/ory/apis/ory-hydra.md) · [All operations](https://skmtc.net/ory/apis/ory-hydra/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/ory/ory-hydra/versions/a302a90a0e8a/schema)