---
title: "Introspect the presented credential"
method: GET
path: "/api/v1/auth/token/introspect"
tags: ["api-tokens"]
---

# Introspect the presented credential

`GET /api/v1/auth/token/introspect`

## Request

- Base URL: `https://api.izap.ai` (the document declares no server; this is the origin it was published from)
- URL: `https://api.izap.ai/api/v1/auth/token/introspect`
- Auth: HTTP bearer

Resolves the credential on the request to its principal, or returns `401` if it is not valid. Accepts a JWT, a session cookie, a personal access token or a business API key — use it to confirm that a token is still good and who it belongs to.

## Response `200`

Successful Response

- PrincipalResponse: Introspection result: who the presented credential authenticates as.
  - `kind` string, required: 'user' or 'business_api_key'.
  - `user_id` string, uuid, nullable: Set when authenticated as a user.
  - `business_id` string, uuid, nullable: Set when authenticated as a business API key.
  - `token_id` string, uuid, nullable: Id of the token row used, if any.

## Other responses

- `401`: Missing or invalid credentials.
- `403`: The credential is valid but not authorized for this action.
- `default`: Unexpected error.

---

[API](https://skmtc.dev/izap/apis/izap-api.md) · [All operations](https://skmtc.dev/izap/apis/izap-api/llms.txt) · [OpenAPI document](https://skmtc.dev/izap/apis/izap-api/revisions/e6358c8bf5e9?raw)