OAuth

Introspect Endpoint

Changed on

Introspect a token (RFC 7662).

Accepts both application/x-www-form-urlencoded (the §2.1 request encoding) and JSON (the platform's own contract) bodies. Both arms require a platform bearer identity, and both answer an unknown, invalid, or expired token value with 200 {"active": false} (§2.2) — only a malformed request body (missing token) is a 400 invalid_request: Problem Details on the JSON arm, the RFC 6749 §5.2 error dialect on the form arm.

post/oauth/introspect

Request

  • Base URL: / (relative, and the document was published on a file host, not at the API’s origin)
  • URL: /oauth/introspect
  • Auth: one of:
    • HTTP bearer
    • OAuth 2 (authorization code, authorization URL /authorize, token URL /oauth/token)

Request body

tokenstring required
token_type_hintstring nullable

Response

Successful Response

activeboolean required

Whether the token is currently valid.

expinteger nullable

Token expiry, in seconds since the Unix epoch; omitted if unknown.

scopestring nullable

Space-separated effective scopes of the token; omitted if unknown.

substring nullable

ID of the actor the token was issued to; omitted if unknown.

token_typestring nullable

Kind of token: access_token or refresh_token; omitted if unknown.

Example response

{
  "active": true,
  "exp": 1769903999,
  "scope": "apis:read capabilities:execute",
  "sub": "agnt_6968b3984d1c238dbe7e2e29",
  "token_type": "access_token"
}

Changes