Read the person's claims
The same claims as the ID token, from the card's state now: a revoked key, a takeover or a suspension changes the answer at once.
/oidc/userinfo- Access
- Private code required
- Client
- Local or server client
Request examples#
curl -fsS -H "Authorization: Bearer $ACCESS_TOKEN" 'https://veil.rip/oidc/userinfo'Response#
The claims of the token's scopes.
| Field | Type | Meaning |
|---|---|---|
sub | string | The card's number, for the card's life. |
name, picture, preferred_username, profile | string | profile: the card's name, its picture's URL, the alias or u<n>, https://veil.rip/u/<n>. |
veil_version, veil_log, veil_good_standing, veil_standing_reasons | mixed | veil: the current version, {origin, index, size, root}, the standing now and why not (suspended, closing, takeover, name_hidden, key_revoked, key_banned). |
veil_accounts | array<object> | veil:accounts: [{platform, id, handle, url, verified_at}]. |
veil_orgs | array<object> | veil:orgs: [{n, name, role}]. |
veil_keys | object | veil:keys: {devices: [{key, alg}], external: [{type, fp}]}. |
Response headers#
| Header | Value | Meaning |
|---|---|---|
Content-Type | application/json | JSON, also for errors. |
Cache-Control | no-store | Private: never cached. |
Usage notes#
- Errors of this endpoint follow OAuth:
{"error", "error_description"}(RFC 6749, 5.2), not theerrorobject of the rest of the API. A rate limit still answers 429 with the usual envelope. - The access token goes in Authorization: Bearer. A 401 carries WWW-Authenticate with the error.
- No API key is read here: an Authorization header on /oidc/ is the app's or the person's own credential.
Errors#
API errors return an error object. Use error.code for program logic; error.message is English text for people and can change. Response and error guide
| HTTP | Code | Meaning and next step |
|---|---|---|
| 401 | invalid_request | OAuth error: no access token in Send the access token in the header, never in the URL. |
| 401 | invalid_token | OAuth error: the access token is invalid, expired or revoked, or the card was closed. Refresh it, or sign the person in again. |
| 401 | veil_suspended | The card is suspended by the Veil staff: userinfo does not answer for it. Treat the person as signed out while the suspension lasts. The card shows why. |
Shared request errors
| HTTP | Code | Meaning and next step |
|---|---|---|
| 429 | rate_limited | An anonymous, signed-request or API-key allowance was exceeded. Wait at least |
| 500 | internal_error | An unexpected server error occurred. Internal details are not returned. Retry reads with bounded backoff. Check write results before sending a new signed operation. |
| 503 | busy | The application has reached a temporary concurrency or database limit. Wait |