{"revision":"9f11a31dd2951db0","language":"en","entry":{"id":"oidc-introspect","kind":"endpoint","group":"oidc","title":"Introspect a token","method":"POST","path":"/oidc/introspect","paths":[],"summary":"RFC 7662, for confidential apps: whether one of the app's own tokens is active now.","response":"{active, …}; {active: false} for any token not active or not the app's.","parameters":[],"sample":"/oidc/introspect","access":"private-code","base":"directory","notes":["Errors of this endpoint follow OAuth: `{\"error\", \"error_description\"}` (RFC 6749, 5.2), not the `error` object of the rest of the API. A rate limit still answers 429 with the usual envelope."],"errors":["400 invalid_request","401 invalid_client","429 rate_limited","500 internal_error","503 busy"],"related":["sign-in-with-veil"],"sections":[{"kind":"code","language":"shell","code":"curl -fsS -u \"$CLIENT_ID:$CLIENT_SECRET\" \\\n  -d token=\"$ACCESS_TOKEN\" \"https://veil.rip/oidc/introspect\""}],"live":false,"responses":[{"status":200,"contentType":"application/json","description":"{active, …}; {active: false} for any token not active or not the app's.","fields":[{"name":"active","type":"boolean","description":"Not revoked, not rotated, not expired, the card open and not suspended."},{"name":"scope, client_id, sub, aud, iss, iat, exp, token_type, auth_time","type":"mixed","description":"As RFC 7662 names them, when active."},{"name":"veil_good_standing","type":"boolean","description":"The card's standing now, when active."}]}],"responseObjects":[],"errorFormat":"json","errorDetails":[{"status":400,"code":"invalid_request","description":"OAuth error: a parameter is missing, given twice or malformed, or the body is not a form.","action":"Read `error_description`, fix the request and send it again.","scope":"endpoint"},{"status":401,"code":"invalid_client","description":"OAuth error: the app could not be authenticated, with the method it registered.","action":"Check the client id and secret (Basic), the client assertion (private_key_jwt, a new jti each time) or client_id for a public app.","scope":"endpoint"},{"status":429,"code":"rate_limited","description":"An anonymous, signed-request or API-key allowance was exceeded.","action":"Wait at least `Retry-After` seconds. Share a queue and retry budget across your workers.","scope":"common"},{"status":500,"code":"internal_error","description":"An unexpected server error occurred. Internal details are not returned.","action":"Retry reads with bounded backoff. Check write results before sending a new signed operation.","scope":"common"},{"status":503,"code":"busy","description":"The application has reached a temporary concurrency or database limit.","action":"Wait `Retry-After` seconds and retry with bounded backoff.","scope":"common"}],"responseHeaders":[{"name":"Content-Type","value":"application/json","description":"JSON, also for errors."},{"name":"Cache-Control","value":"no-store","description":"Private: never cached."}],"bodyFields":[{"name":"token","in":"body","required":true,"description":"The token."}],"documentationUrl":"https://veil.rip/docs/oidc-introspect","supportsBrowserFetch":false,"browserMode":"local-or-server"}}