---
title: "Issue UserInfo Response"
method: POST
path: "/api/{serviceId}/auth/userinfo/issue"
tags: ["UserInfo Endpoint"]
---

# Issue UserInfo Response

`POST /api/{serviceId}/auth/userinfo/issue`

This API generates an ID token.

## Path parameters

- `serviceId` string, required

## Request body

- UserinfoIssueRequest
  - `token` string, required — The access token that has been passed to the userinfo endpoint by the client application. In other words, the access token which was contained in the userinfo request.
  - `claims` string — Claims in JSON format. As for the format, see [OpenID Connect Core 1.0, 5.1. Standard Claims](https://openid.net/specs/openid-connect-core-1_0.html#StandardClaims).
  - `sub` string — The value of the `sub` claim. If the value of this request parameter is not empty, it is used as the value of the `sub` claim. Otherwise, the value of the subject associated with the access token is used.
  - `claimsForTx` string — Claim key-value pairs that are used to compute transformed claims.
  - `requestSignature` string — The Signature header value from the request.
  - `headers` Pair[] — HTTP headers to be included in processing the signature. If this is a signed request, this must include the Signature and Signature-Input headers, as well as any additional headers covered by the signature.
    - `key` string — The key part.
    - `value` string — The value part.
  - `verifiedClaimsForTx` string[] — Values of verified claims requested indirectly by "transformed claims".

## Response `200`

User info issued successfully

- UserinfoIssueResponse
  - `resultCode` string — The code which represents the result of the API call.
  - `resultMessage` string — A short message which explains the result of the API call.
  - `action` 'INTERNAL_SERVER_ERROR' | 'BAD_REQUEST' | 'UNAUTHORIZED' | 'FORBIDDEN' | 'JSON' | 'JWT' — The next action that the authorization server implementation should take.
  - `responseContent` string — The content that the authorization server implementation can use as the value of `WWW-Authenticate` header on errors.
  - `signature` string — The signature header of the response message.
  - `signatureInput` string — The signature-input header of the response message
  - `contentDigest` string — The content-digest header of the response message

## Other responses

- `400`
- `401`
- `403`
- `429` — The request exceeded the request rate permitted for the endpoint.
- `500`

## Changes

- **2026-08-03** `7ad74ab64749` — 1 info
  - added the non-success response with the status `429`

[Change history](https://skmtc.dev/authlete/apis/authlete-api/changes/api/:serviceId/auth/userinfo/issue/post.md)

---

[API](https://skmtc.dev/authlete/apis/authlete-api.md) · [All operations](https://skmtc.dev/authlete/apis/authlete-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/authlete/authlete-api/revisions/7ad74ab64749/schema)