IBibm
Introspection Endpoint

Use this endpoint to retrieve token metadata

Query the authorization server to determine the set of metadata for a given token. This metadata includes whether or not the token is currently active (or if it has expired or otherwise been revoked), what rights of access the token carries (usually conveyed through OAuth 2.0 scopes), and the authorization context in which the token was granted (including who authorized the token and which client it was issued to).

post/introspect

Request

  • Base URL
    https://{pointofcontact}/oauth2
  • Auth
    HTTP basic

Headers

x-client-certificatestring

MTLS Client Certificate

Request body application/x-www-form-urlencoded

tokenstring required

The string value of the token

token_type_hint'access_token' | 'refresh_token'

A hint about the type of the token submitted for introspection

client_idstring

OAuth2.0 client identifier. Required when the client authentication method is using "client_secret_post" or "tls_client_auth". It is optional when using "private_key_jwt" client authentication; when specified it MUST match the "client_assertion" subject.

client_secretstring

OAuth2.0 client secret. May be specified when using "client_secret_post" client authentication method.

client_assertionstring

The "private_key_jwt" assertion being used to authenticate the client.

client_assertion_type'urn:ietf:params:oauth:client-assertion-type:jwt-bearer'

Type of the client assertion.

Response

Metadata associated with the given token.

activeboolean required

Boolean indicator of whether or not the presented token is currently active.

scopestring

Space-delimited string containing the scopes associated with this token.

client_idstring

Client identifier that requested this token.

usernamestring

Human-readable identifier for the resource owner who authorized this token.

token_type'Bearer'

Type of the token

grant_idstring

Unique identifier of an authorization grant

expinteger

Integer timestamp, measured in the number of seconds since January 1 1970 UTC, indicating when this token will expire

iatinteger

Integer timestamp, measured in the number of seconds since January 1 1970 UTC, indicating when this token was originally issued

nbfinteger

Integer timestamp, measured in the number of seconds since January 1 1970 UTC, indicating when this token is not to be used before

substring

Subject of the token. Usually a machine-readable identifier of the resource owner who authorized this token.

audobject

Service-specific string identifier or list of string identifiers representing the intended audience for this token

issstring

String representing the issuer of this token

jtistring

String identifier for the token

Changes

No recorded changes to this operation across all 1 revision of this API.