---
title: "Introspect a QVeris resource token"
method: POST
path: "/oauth/introspect"
tags: ["Authentication"]
---

# Introspect a QVeris resource token

`POST /oauth/introspect`

## Request

- Base URL: `https://qveris.ai/api/v1`
- URL: `https://qveris.ai/api/v1/oauth/introspect`
- Auth: HTTP basic

RFC 7662-compatible introspection for allowlisted confidential Resource Server clients. resource is mandatory and must exactly match both the client registration and token audience. Invalid, expired, revoked, or wrong-audience tokens return only {"active": false}.

## Response `200`

Successful Response

- union
  - OAuthIntrospectionActiveResponse
    - `active` true, required
    - `token_type` 'Bearer', required
    - `scope` string, required
    - `client_id` string, required
    - `sub` string, required
    - `token_use` 'access' | 'delegation', required
    - `exp` integer, required
    - `iat` integer, required
    - `nbf` integer, required
    - `aud` string, required
    - `iss` string, required
    - `jti` string, required
    - `actor` OAuthDelegationActor: Confidential Agent Runtime that requested a delegation token.
      - `client_id` string, required
    - `parent_jti` string, nullable
    - `delegation` OAuthDelegationConstraints
      - `model` string, nullable
      - `tool_ids` string[], nullable
      - `provider_ids` string[], nullable
      - `run_id` string, nullable
      - `max_credits` integer, nullable
  - OAuthIntrospectionInactiveResponse
    - `active` false, required

## Other responses

- `400`: OAuth request or grant error
- `401`: Client authentication or bearer-token error
- `403`: Subject token has insufficient scope
- `422`: Validation Error

---

[API](https://skmtc.dev/qveris/apis/qveris-public-rest-api.md) · [All operations](https://skmtc.dev/qveris/apis/qveris-public-rest-api/llms.txt) · [OpenAPI document](https://skmtc.dev/qveris/apis/qveris-public-rest-api/revisions/7b78aeef092a?raw)