---
title: "Inspect the scopes, clone resources, expiry, and revocation state of a grant token."
method: POST
path: "/v1/inspect_external_authorization"
tags: ["External Authorization"]
---

# Inspect the scopes, clone resources, expiry, and revocation state of a grant token.

`POST /v1/inspect_external_authorization`

## Request

- Base URL: `https://partner.mindupload.app`
- URL: `https://partner.mindupload.app/v1/inspect_external_authorization`
- Auth: API key in header `X-Partner-Key`

Returns only authorization metadata. It never returns an owner password, session token, external identifier, memory, or conversation content.

## Request body

- object
  - `preferred_language` string, nullable: BCP-47-ish language code (e.g. 'en', 'zh-cn') for localized messages.
  - `access_token` string, required: Opaque grant token accepted only by grant inspection and external clone invocation; store it as a secret and never expose it to users.

## Response `200`

Result envelope — check the success field.

- object
  - `success` boolean, required: Whether the call succeeded.
  - `error_message` string, nullable, required: Human-readable reason when success is false.
  - `error_code` string
  - `grant_id` string, nullable, required: Stable grant identifier used by the owner-facing revocation surface.
  - `status` 'active' | 'revoked' | 'expired', nullable, required: Current authorization or invocation lifecycle state.
  - `scopes` string[], nullable, required: Capabilities approved by the owner.
  - `clone_ids` string[], nullable, required: AI consciousness resources selected by the owner.
  - `created_at` integer, nullable, required
  - `access_token_expires_at` integer, nullable, required: UNIX timestamp after which the short-lived access token must be refreshed.
  - `expires_at` integer, nullable, required: UNIX timestamp when this resource or capability expires.
  - `revoked_at` integer, nullable, required: UNIX timestamp when the owner revoked the grant, or null.

## Other responses

- `400`: Invalid request payload.
- `401`: Missing or invalid partner key.
- `403`: Partner is not authorized for this operation.
- `429`: Rate limit exceeded — retry later.
- `500`: Internal server error.

---

[API](https://skmtc.dev/mindupload/apis/mind-upload-partner-api.md) · [All operations](https://skmtc.dev/mindupload/apis/mind-upload-partner-api/llms.txt) · [OpenAPI document](https://skmtc.dev/mindupload/apis/mind-upload-partner-api/revisions/0371bdf78533?raw)