Internal

Introspect live connector token status

Every-request fail-closed validation for product resource servers. The authenticated product principal must be allowed for the token connector. The broker binds the jti issuance record, connection, user, immutable organization, connector, credential generation, audience, active lifecycle state, and current product entitlement. Stale tokens return active=false.

post/v1/internal/connections/status

Request

Base URL: / (relative, and the document was published on a file host, not at the API’s origin)
URL: /v1/internal/connections/status
Auth: one of:
- API key in header X-Connector-Signature
- HTTP bearer

Request body

audiencestring required

Exact product resource audience.

connection_idstring required

Immutable MCPConnection UUID from the token.

connectorstring required

Connector slug.

credential_generationinteger required

Credential lifecycle generation minted into the token.

jtistring required

JWT ID from the verified product token.

organization_idstring required

Immutable grant-time organization.

workos_user_idstring required

WorkOS user id used to resolve bearer tokens into local users.

Example request

{
  "audience": "mcp:canvas",
  "connection_id": "123e4567-e89b-12d3-a456-426614174000",
  "connector": "canvas",
  "credential_generation": 3,
  "jti": "2ea124ab-866b-4c10-8e73-f0a6978f09ca",
  "organization_id": "org_01HABCDEF",
  "workos_user_id": "user_01HABCDEF"
}

Response

Live token status. Any stale binding returns active=false.

activeboolean required

True only when every token binding, issuance record, live connection state, generation, and entitlement still match.

Example response

{
  "active": true
}

Changes

No operation changes recorded.