OAuth

OAuth2 token introspection endpoint

Changed on

Returns metadata about an Aura Historia access token (RFC 7662). The request body must be application/x-www-form-urlencoded. Client authentication is performed via client_id / client_secret form fields.

If the token is unknown, expired, or revoked, active is false and all other fields are omitted. Otherwise active is true and the available token metadata is populated.

post/api/v1/oauth/introspect

Request

  • Base URL: https://api.stage.aura-historia.com
  • URL: https://api.stage.aura-historia.com/api/v1/oauth/introspect
  • Auth: none declared

Response

Introspection result. active: false means the token is unknown, expired, or revoked.

activeboolean required

Whether the token is currently active (not expired, not revoked, and known to this server).

scopestring

Space-separated list of scopes granted to the token. Present only when active is true.

client_idstring

OAuthClient ID that issued the token. Present only when active is true and the token was issued via the OAuth flow.

substring

Subject — the Aura Historia user ID who authorized the token. Present only when active is true.

token_typestring

Token type. Always "Bearer" when active is true.

expinteger

Unix timestamp (seconds) when the token expires. Present only when active is true and the token has an expiry.

iatinteger

Unix timestamp (seconds) when the token was issued. Present only when active is true and the issue time is known.

Example response

{
  "active": true,
  "scope": "product-listings:write",
  "client_id": "oc_7b0gwc1x49e0mvbt3tfexfqgb5",
  "sub": "usr_4hzreqwxgvef69j056bszwwm17",
  "token_type": "Bearer",
  "exp": 1780000000,
  "iat": 1748400000
}

Changes

  • 999eda3fdd63Revision changes
    • breaking

      the response's property format changed from uuid to no format for status

    • breaking

      the response's property format changed from uuid to no format for status

    • breaking

      removed the required property / from the response with the status

    • breaking

      removed the required property / from the response with the status

    • breaking

      removed the required property / from the response with the status

    • info

      the request property format was generalized from uuid to no format

    • info

      added the required property / to the response with the status

    • info

      added the required property / to the response with the status

    • info

      added the required property / to the response with the status