---
title: "Introspect Endpoint"
method: POST
path: "/realms/public/protocol/openid-connect/token/introspect"
tags: ["auth-keycloak"]
---

# Introspect Endpoint

`POST /realms/public/protocol/openid-connect/token/introspect`

RFC 7662 token introspection.

The hosted MCP gateway calls this to validate a caller's bearer token: we
sign tokens HS256 (symmetric), so there is no JWKS for the gateway to verify
against — it asks us instead. The gateway authenticates as a confidential
client (client_secret_basic); we then decode the token and return its claims.

Per RFC 7662 an *inactive*/invalid token is a normal `200 {"active": false}`
— only a CALLER authentication failure is a non-200 (401), and an unconfigured
env is 503.

## Headers

- `authorization` string, nullable

## Response `200`

Successful Response

- unknown

## Other responses

- `401` — Unauthorized
- `403` — Forbidden
- `404` — Not Found
- `422` — Validation Error
- `500` — Internal Server Error

---

[API](https://skmtc.dev/geopera/apis/geopera-data-platform.md) · [All operations](https://skmtc.dev/geopera/apis/geopera-data-platform/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/geopera/geopera-data-platform/revisions/27294869ca25/schema)