ORory
oAuth2

Introspect OAuth2 Access and Refresh Tokens

Changed on

The introspection endpoint allows to check if a token (both refresh and access) is active or not. An active token is neither expired nor revoked. If a token is active, additional information on the token will be included. You can set additional data for a token by setting session.access_token during the consent flow.

post/admin/oauth2/introspect

Request

  • Base URL
    / (relative, and the document was published on a file host, not at the API’s origin)
  • URL
    /admin/oauth2/introspect
  • Auth
    none declared

Request body application/x-www-form-urlencoded

tokenstring required

The string value of the token. For access tokens, this is the "access_token" value returned from the token endpoint defined in OAuth 2.0. For refresh tokens, this is the "refresh_token" value returned.

scopestring

An optional, space separated list of required scopes. If the access token was not granted one of the scopes, the result of active will be false.

Response

introspectedOAuth2Token

activeboolean required

Active is a boolean indicator of whether or not the presented token is currently active. The specifics of a token's "active" state will vary depending on the implementation of the authorization server and the information it keeps about its tokens, but a "true" value return for the "active" property will generally indicate that a given token has been issued by this authorization server, has not been revoked by the resource owner, and is within its given time window of validity (e.g., after its issuance time and before its expiration time).

audstring[]

Audience contains a list of the token's intended audiences.

client_idstring

ID is a client identifier for the OAuth 2.0 client that requested this token.

expinteger

Expires at is an integer timestamp, measured in the number of seconds since January 1 1970 UTC, indicating when this token will expire.

extobject

Extra is arbitrary data set by the session.

iatinteger

Issued at is an integer timestamp, measured in the number of seconds since January 1 1970 UTC, indicating when this token was originally issued.

issstring

IssuerURL is a string representing the issuer of this token

nbfinteger

NotBefore is an integer timestamp, measured in the number of seconds since January 1 1970 UTC, indicating when this token is not to be used before.

obfuscated_subjectstring

ObfuscatedSubject is set when the subject identifier algorithm was set to "pairwise" during authorization. It is the sub value of the ID Token that was issued.

scopestring

Scope is a JSON string containing a space-separated list of scopes associated with this token.

substring

Subject of the token, as defined in JWT [RFC7519]. Usually a machine-readable identifier of the resource owner who authorized this token.

token_typestring

TokenType is the introspected token's type, typically Bearer.

token_usestring

TokenUse is the introspected token's use, for example access_token or refresh_token.

usernamestring

Username is a human-readable identifier for the resource owner who authorized this token.

Changes

  • 3e5674bbe997Revision changes
    • info

      api operation id adminIntrospectOAuth2Token removed and replaced with introspectOAuth2Token

    • info

      api tag oAuth2 added

    • info

      api tag v0alpha2 removed

  • cec56a3dc789Revision changes
    • info

      api operation id introspectOAuth2Token removed and replaced with adminIntrospectOAuth2Token

    • info

      api tag v0alpha2 added

    • info

      api tag oAuth2 removed