Sign in

v10

latestOpenAPI 3.0.0raw.githubusercontent.com2026-07-0582185581.9 KB
OAuth Provider

Introspect a token

OAuth 2.0 Token Introspection Endpoint (RFC 7662).

Check if a token is active and retrieve its metadata.

Use Cases:

  • Resource servers validating tokens
  • Debugging token issues
  • Checking token scopes before processing requests

Response:

  • Active token: Returns active: true with token metadata
  • Invalid/expired/revoked token: Returns only active: false
post/oauth2/introspect

Request body

tokenstring required

The token to introspect

token_type_hint'access_token' | 'refresh_token'

Hint about token type

client_idstring required

Client ID

client_secretstring

Client secret

Response

Token introspection result

activeboolean required

Whether the token is currently active

scopestring

Scopes granted to the token

client_idstring

Client ID the token was issued to

usernamestring

User identifier (if user-based token)

token_typestring

Token type

expinteger

Token expiration timestamp (Unix epoch)

iatinteger

Token issuance timestamp (Unix epoch)

nbfinteger

Token not-before timestamp (Unix epoch)

user_idstring

User ID

audstring

Audience (client ID)

issstring

Issuer URL

jtistring

Unique token identifier