OAuth

OAuth 2.0 token introspection (RFC 7662)

Returns the activeness + metadata of an access token per RFC 7662. The caller MUST authenticate: because Mnemom's OAuth clients are public (no client secret), there is no client-credentials path, so the caller authenticates as a USER (bearer / api-key / cookie). active:true with full metadata is returned ONLY when the token is live AND the authenticated caller owns/admins the token's org; otherwise the response is {active:false} with no other fields — the endpoint is never a token existence/validity oracle for tokens the caller does not control. Only opaque access tokens (mcp_at_) are introspectable; refresh tokens and unknown values report active:false.

post/oauth/introspect

Request

  • Base URL: https://api.mnemom.ai/v1
  • URL: https://api.mnemom.ai/v1/oauth/introspect
  • Auth: one of:
    • HTTP bearer
    • API key in header X-Mnemom-Api-Key
    • API key in cookie mnemom_session

Request body

tokenstring required

The access token to introspect.

token_type_hint'access_token'

Response

RFC 7662 introspection response.

activeboolean required
scopestring
client_idstring
token_type'Bearer'
expinteger

Expiry, seconds since epoch.

substring

The consenting user id.

org_idstring

Changes

No recorded changes to this operation across all 1 revision of this API.