---
title: "JWT decoder: header, claims and expiry state (no signature verification)"
method: GET
path: "/v1/code/jwt"
tags: ["no-api-key", "code", "jwt", "security"]
---

# JWT decoder: header, claims and expiry state (no signature verification)

`GET /v1/code/jwt`

## Request

- Base URL: `https://api.duoleads.com`
- URL: `https://api.duoleads.com/v1/code/jwt`
- Auth: none declared

JWT decoder: decode a JSON Web Token without verifying it: returns the header, the claims, the signature length and algorithm, and a computed view of the time claims — whether exp has passed, whether nbf is in the future, and the remaining lifetime in seconds against a supplied or current instant. Reports structural problems such as a missing part, invalid base64url or an alg of none. It does not and cannot verify the signature; do not use it to decide trust.

**Output (`data`):** valid_structure, header and payload (the decoded JSON objects echoed exactly as sent, including non-conforming values; null when absent or not an object), alg, typ, kid (each string|null: null when the header lacks it or it is not a string), signature_bytes, parts, claims {iss, sub, aud, exp, nbf, iat, jti} (the RFC 7519 registered claims, normalised: iss, sub and jti are strings, aud is a string or an array of strings, exp, nbf and iat are numbers; each is null when absent or when its value does not conform), claim_errors [{claim, reason}] (present only when a registered claim did not conform and was nulled in claims, e.g. aud: 5 or exp: "soon"), time {evaluated_at, expired (boolean|null, null without a conforming exp), not_yet_valid (boolean|null, null without a conforming nbf), expires_in_seconds (integer|null, null without a conforming exp), age_seconds (integer|null, null without a conforming iat)}, signature_verified (always false), warnings [], reason.

Deterministic only when the query fixes the instant; otherwise the answer depends on the current time and is served `no-store`. `meta.deterministic` says which.

Price: $0.05 USDC per call (x402, Base). Route contract version 1.0.0. Docs: https://api.duoleads.com/docs#code-jwt

## Query parameters

- `token` string, required
- `at` string

## Response `200`

Paid and settled. `data` is route-specific; a route that judges its input returns 200 with `data.valid: false` for a bad value.

- object
  - `ok` unknown, required
  - `route` '/v1/code/jwt', required
  - `version` '1.0.0', required
  - `data` object, required: valid_structure, header and payload (the decoded JSON objects echoed exactly as sent, including non-conforming values; null when absent or not an object), alg, typ, kid (each string|null: null when the header lacks it or it is not a string), signature_bytes, parts, claims {iss, sub, aud, exp, nbf, iat, jti} (the RFC 7519 registered claims, normalised: iss, sub and jti are strings, aud is a string or an array of strings, exp, nbf and iat are numbers; each is null when absent or when its value does not conform), claim_errors [{claim, reason}] (present only when a registered claim did not conform and was nulled in claims, e.g. aud: 5 or exp: "soon"), time {evaluated_at, expired (boolean|null, null without a conforming exp), not_yet_valid (boolean|null, null without a conforming nbf), expires_in_seconds (integer|null, null without a conforming exp), age_seconds (integer|null, null without a conforming iat)}, signature_verified (always false), warnings [], reason.
    - `valid_structure` boolean, required
    - `header` object, nullable, required: caller-supplied content echoed exactly as decoded: members are not typed
    - `payload` object, nullable, required: caller-supplied content echoed exactly as decoded: members are not typed
    - `alg` string, nullable, required
    - `typ` string, nullable, required
    - `kid` string, nullable, required
    - `signature_bytes` integer, required
    - `parts` integer, required
    - `claims` object, required
      - `iss` string, nullable, required
      - `sub` string, nullable, required
      - `aud` union, required: RFC 7519 4.1.3: string or array of strings; null when absent
        - string
        - string[]
      - `exp` number, nullable, required
      - `nbf` number, nullable, required
      - `iat` number, nullable, required
      - `jti` string, nullable, required
    - `time` object, required
      - `evaluated_at` string, required
      - `expired` boolean, nullable, required
      - `not_yet_valid` boolean, nullable, required
      - `expires_in_seconds` integer, nullable, required
      - `age_seconds` integer, nullable, required
    - `signature_verified` boolean, required
    - `warnings` string[], required
    - `reason` string, nullable, required
    - `claim_errors` object[]
      - `claim` string, required
      - `reason` string, required
  - `meta` Meta, required
    - `disclaimer` string, required: Legal short disclaimer, identical on every response.
    - `request_id` string, required: ULID.
    - `computed_at` string, date-time, required: RFC 3339 UTC with milliseconds.
    - `price_usd` string, required: Decimal string, "0.05".
    - `deterministic` boolean, required
    - `sources` object[]: Present only on routes that read a vendored dataset: the exact edition that answered.
      - `id` string, required
      - `version` string, required
      - `published` string, required
      - `attribution` string
      - `licence` string

## Other responses

- `400`: MISSING_PARAM, INVALID_PARAM or UNSUPPORTED_VALUE. Not charged: validation runs before the paywall.
- `402`: Payment required. No valid PAYMENT-SIGNATURE was supplied: read the base64 PAYMENT-REQUIRED header (or this body) for the price ($0.05 = 50000 atomic USDC on eip155:8453), sign an EIP-3009 authorization and retry. Also returned when settlement is declined (PAYMENT_FAILED). Nothing is charged on a 402.
- `404`: NOT_FOUND: unknown path. Not charged.
- `405`: METHOD_NOT_ALLOWED: only GET and HEAD are served. Not charged.
- `413`: INPUT_TOO_LARGE: a parameter exceeded its documented maximum length. Not charged.
- `500`: INTERNAL: a server bug. Not charged.

---

[API](https://skmtc.dev/duoleads/apis/duo-data-utilities-iban-isin-vat-tax-id-barcode-timezone-geo.md) · [All operations](https://skmtc.dev/duoleads/apis/duo-data-utilities-iban-isin-vat-tax-id-barcode-timezone-geo/llms.txt) · [OpenAPI document](https://skmtc.dev/duoleads/apis/duo-data-utilities-iban-isin-vat-tax-id-barcode-timezone-geo/revisions/18790d59615e?raw)