{"revision":"9f11a31dd2951db0","language":"en","entry":{"id":"oidc-userinfo","kind":"endpoint","group":"oidc","title":"Read the person's claims","method":"GET","path":"/oidc/userinfo","paths":[],"summary":"The same claims as the ID token, from the card's state now: a revoked key, a takeover or a suspension changes the answer at once.","response":"The claims of the token's scopes.","parameters":[],"sample":"/oidc/userinfo","access":"private-code","base":"directory","notes":["Errors of this endpoint follow OAuth: `{\"error\", \"error_description\"}` (RFC 6749, 5.2), not the `error` object of the rest of the API. A rate limit still answers 429 with the usual envelope.","The access token goes in Authorization: Bearer. A 401 carries WWW-Authenticate with the error.","No API key is read here: an Authorization header on /oidc/ is the app's or the person's own credential."],"errors":["401 invalid_request","401 invalid_token","401 veil_suspended","429 rate_limited","500 internal_error","503 busy"],"related":["sign-in-with-veil"],"sections":[{"kind":"code","language":"shell","code":"curl -fsS -H \"Authorization: Bearer $ACCESS_TOKEN\" 'https://veil.rip/oidc/userinfo'"}],"live":false,"responses":[{"status":200,"contentType":"application/json","description":"The claims of the token's scopes.","fields":[{"name":"sub","type":"string","description":"The card's number, for the card's life."},{"name":"name, picture, preferred_username, profile","type":"string","description":"profile: the card's name, its picture's URL, the alias or u<n>, https://veil.rip/u/<n>."},{"name":"veil_version, veil_log, veil_good_standing, veil_standing_reasons","type":"mixed","description":"veil: the current version, {origin, index, size, root}, the standing now and why not (suspended, closing, takeover, name_hidden, key_revoked, key_banned)."},{"name":"veil_accounts","type":"array<object>","description":"veil:accounts: [{platform, id, handle, url, verified_at}]."},{"name":"veil_orgs","type":"array<object>","description":"veil:orgs: [{n, name, role}]."},{"name":"veil_keys","type":"object","description":"veil:keys: {devices: [{key, alg}], external: [{type, fp}]}."}]}],"responseObjects":[],"errorFormat":"json","errorDetails":[{"status":401,"code":"invalid_request","description":"OAuth error: no access token in `Authorization: Bearer`.","action":"Send the access token in the header, never in the URL.","scope":"endpoint"},{"status":401,"code":"invalid_token","description":"OAuth error: the access token is invalid, expired or revoked, or the card was closed.","action":"Refresh it, or sign the person in again.","scope":"endpoint"},{"status":401,"code":"veil_suspended","description":"The card is suspended by the Veil staff: userinfo does not answer for it.","action":"Treat the person as signed out while the suspension lasts. The card shows why.","scope":"endpoint"},{"status":429,"code":"rate_limited","description":"An anonymous, signed-request or API-key allowance was exceeded.","action":"Wait at least `Retry-After` seconds. Share a queue and retry budget across your workers.","scope":"common"},{"status":500,"code":"internal_error","description":"An unexpected server error occurred. Internal details are not returned.","action":"Retry reads with bounded backoff. Check write results before sending a new signed operation.","scope":"common"},{"status":503,"code":"busy","description":"The application has reached a temporary concurrency or database limit.","action":"Wait `Retry-After` seconds and retry with bounded backoff.","scope":"common"}],"responseHeaders":[{"name":"Content-Type","value":"application/json","description":"JSON, also for errors."},{"name":"Cache-Control","value":"no-store","description":"Private: never cached."}],"documentationUrl":"https://veil.rip/docs/oidc-userinfo","supportsBrowserFetch":false,"browserMode":"local-or-server"}}