Skip to content
OpenID Connect & OAuth 2....
/
/
/introspect

/introspect

Request

CORS

This endpoint takes an access token, ID token, refresh token, or device secret and returns a boolean that indicates whether it's active. If the token is active, additional data about the token is also returned. If the token is invalid, expired, or revoked, it's considered inactive.

Ensure that you are using the /introspect endpoint of the same authorization server that you used to create the token.

Note: The /introspect endpoint requires client authentication. The method is configured per client app. See Client authentication methods. For public clients (such as single-page and mobile apps) that don't have a client_secret, you must include the client_id as a query parameter when calling the /introspect endpoint. Make sure that you aren't passing the Authorization header in the request.

Path
authorizationServerIdstringrequired

id of the authorization server

Bodyapplication/x-www-form-urlencoded
tokenstring

An access token, ID token, refresh token, or a device secret.

Note: Although ID tokens can be sent to this endpoint, they are usually validated on the service provider or app side of a flow.

token_type_hintstring(TokenTypeHintIntrospect)

Indicates the type of token being passed

Enum:"access_token""device_secret""id_token""refresh_token"
POST
/oauth2/{authorizationServerId}/v1/introspect
curl -i -X POST \
  'https://okta-subdomain.pixtulate.com/oauth2/{authorizationServerId}/v1/introspect' \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  -d token=string \
  -d token_type_hint=access_token

Responses

Based on the type of token and whether it's active, the returned JSON contains a different set of information.

Bodyapplication/json
activeboolean

Indicates whether the token is active or not

audstring

The audience of the token

client_idstring

The ID of the client associated with the token

device_idstring

The ID of the device associated with the token

expinteger

The expiration time of the token in seconds since January 1, 1970 UTC

iatinteger

The issuing time of the token in seconds since January 1, 1970 UTC

issstring

The issuer of the token

jtistring

The identifier of the token

nbfinteger

Identifies the time (a timestamp in seconds since January 1, 1970 UTC) before which the token must not be accepted for processing

scopestring

A space-delimited list of scopes

substring

The subject of the token

token_typestring

The type of token. The value is always Bearer.

uidstring

The user ID. This parameter is returned only if the token is an access token and the subject is an end user.

usernamestring

The username associated with the token.

property name*anyadditional property
Response
{
  "active": true,
  "token_type": "Bearer",
  "scope": "openid profile",
  "client_id": "a9VpZDRCeFh3Nkk2VdYa",
  "username": "john.doe@example.com",
  "exp": 1451606400,
  "iat": 1451602800,
  "sub": "john.doe@example.com",
  "aud": "https://{yourOktaDomain}",
  "iss": "https://{yourOktaDomain}/oauth2/orsmsg0aWLdnF3spV0g3",
  "jti": "AT.7P4KlczBYVcWLkxduEuKeZfeiNYkZIC9uGJ28Cc-YaI",
  "uid": "00uid4BxXw6I6TV4m0g3"
}