--- title: "Process OAuth 2.0 Introspection Request" method: POST path: "/api/{serviceId}/auth/introspection/standard" tags: ["Introspection Endpoint"] --- # Process OAuth 2.0 Introspection Request `POST /api/{serviceId}/auth/introspection/standard` This API exists to help your authorization server provide its own introspection API which complies with [RFC 7662](https://tools.ietf.org/html/rfc7662) (OAuth 2.0 Token Introspection). ## Path parameters - `serviceId` string, required ## Request body - StandardIntrospectionRequest - `parameters` string, required — Request parameters which comply with the introspection request defined in "[2.1. Introspection Request](https://datatracker.ietf.org/doc/html/rfc7662#section-2.1)" in RFC 7662. The implementation of the introspection endpoint of your authorization server will receive an HTTP POST [[RFC 7231](https://datatracker.ietf.org/doc/html/rfc7231)] request with parameters in the `application/x-www-form-urlencoded` format. It is the entity body of the request that Authlete's `/api/auth/introspection/standard` API expects as the value of `parameters`. - `withHiddenProperties` boolean — Flag indicating whether to include hidden properties in the output. Authlete has a mechanism whereby to associate arbitrary key-value pairs with an access token. Each key-value pair has a hidden attribute. By default, key-value pairs whose hidden attribute is set to `true` are not embedded in the standard introspection output. If the `withHiddenProperties` request parameter is given and its value is `true`, `/api/auth/introspection/standard API includes all the associated key-value pairs into the output regardless of the value of the hidden attribute. - `rsUri` string — The URI of the resource server making the introspection request. If the `rsUri` request parameter is given and the token has audience values, Authlete checks if the value of the `rsUri` request parameter is contained in the audience values. If not contained, Authlete generates an introspection response with the `active` property set to `false`. The `rsUri` request parameter is required when the resource server requests a JWT introspection response, i.e., when the value of the `httpAcceptHeader` request parameter is set to `"application/token-introspection+jwt"`. - `httpAcceptHeader` string — The value of the `HTTP Accept` header in the introspection request. If the value of the `httpAcceptHeader` request parameter is `"application/token-introspection+jwt"`, Authlete generates a JWT introspection response. See "[4. Requesting a JWT Response](https://www.rfc-editor.org/rfc/rfc9701.html#section-4)" of "[RFC 9701: JWT Response for OAuth Token Introspection](https://www.rfc-editor.org/rfc/rfc9701.html)" for more details. - `introspectionSignAlg` string — The JWS `alg` algorithm for signing the introspection response. This parameter corresponds to `introspection_signed_response_alg` defined in "[6. Client Metadata](https://www.rfc-editor.org/rfc/rfc9701.html#section-6)" of "[RFC 9701: JWT Response for OAuth Token Introspection](https://www.rfc-editor.org/rfc/rfc9701.html)". The default value is `RS256`. - `introspectionEncryptionAlg` string — The JWE `alg` algorithm for encrypting the introspection response. This parameter corresponds to `introspection_encrypted_response_alg` defined in "[6. Client Metadata](https://www.rfc-editor.org/rfc/rfc9701.html#section-6)" of "[RFC 9701: JWT Response for OAuth Token Introspection](https://www.rfc-editor.org/rfc/rfc9701.html)". If the `introspectionEncryptionAlg` request parameter is specified, Authlete generates a JWT introspection response encrypted with the algorithm by this property and the algorithm specified by the `introspectionEncryptionEnc` request parameter. - `introspectionEncryptionEnc` string — The JWE `enc` algorithm for encrypting the introspection response. This parameter corresponds to `introspection_encrypted_response_enc` defined in "[6. Client Metadata](https://www.rfc-editor.org/rfc/rfc9701.html#section-6)" of "[RFC 9701: JWT Response for OAuth Token Introspection](https://www.rfc-editor.org/rfc/rfc9701.html)". The default value is `A128CBC_HS256`. - `sharedKeyForSign` string — The shared key for signing the introspection response with a symmetric algorithm. The `sharedKeyForSign` request parameter is required when the introspection response is requested to be signed with a symmetric algorithm. - `sharedKeyForEncryption` string — The shared key for encrypting the introspection response with a symmetric algorithm. The `sharedKeyForEncryption` request parameter is required when the introspection response is requested to be encrypted with a symmetric algorithm. - `publicKeyForEncryption` string — The public key for signing the introspection response with an asymmetric algorithm. The `publicKeyForEncryption` request parameter is required when the introspection response is requested to be encrypted with an asymmetric algorithm. ## Response `200` Token introspection completed successfully - StandardIntrospectionResponse - `resultCode` string — The code which represents the result of the API call. - `resultMessage` string — A short message which explains the result of the API call. - `action` 'INTERNAL_SERVER_ERROR' | 'BAD_REQUEST' | 'OK' | 'JWT' — The next action that the authorization server implementation should take. - `responseContent` string — The content that the authorization server implementation is to return to the client application. ## Other responses - `400` - `401` - `403` - `429` — The request exceeded the request rate permitted for the endpoint. - `500` ## Changes - **2026-08-03** `7ad74ab64749` — 1 info - added the non-success response with the status `429` - **2026-01-15** `8a534bc68775` — 1 warning - added the new `JWT` enum value to the `action` response property for the response status `200` [Change history](https://skmtc.dev/authlete/apis/authlete-api/changes/api/:serviceId/auth/introspection/standard/post.md) --- [API](https://skmtc.dev/authlete/apis/authlete-api.md) · [All operations](https://skmtc.dev/authlete/apis/authlete-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/authlete/authlete-api/revisions/7ad74ab64749/schema)