GET/api/oidc/userinfoPublic

Userinfo endpoint

The OpenID Connect userinfo endpoint (OIDC Core §5.3). Presents the access token issued by the token endpoint as Authorization: Bearer <access_token>; the server decrypts and verifies it (only tokens minted for the reserved oidc-userinfo audience are accepted) and returns the claims permitted by the token's granted scope: sub always, email / email_verified with the email scope, and the profile name claims (read fresh from the user's profile) with the profile scope. Tokens from a plain OAuth 2.1 grant (no openid scope) are refused with 403 insufficient_scope. Served with Access-Control-Allow-Origin: * and Cache-Control: no-store. OIDC Core §5.3.1 allows POST as well as GET; form-body token delivery is not supported (the token must be in the Authorization header).

operationId get_api_oidc_userinfoOpenID Connect / OAuth 2.0

Authentication & permissionsPublic

Anyone — no credentials required

Accepted credentials: None required
Notes: Bearer access token minted by POST /api/oidc/token for the reserved oidc-userinfo audience (RFC 6750 §2.1). The handler verifies it itself; the platform's session cookies are not accepted here.

Responses

Header	Type	Description
Cache-Control	string

application/json

OidcUserinfoClaimsOIDC Core §5.3.2 claims, filtered by the access token's granted scope.

Property	Type	Description
sub*	string	Subject identifier in the `<auth_server_app_id>\|<uid>` form; always present and identical to the id_token's `sub`.
email	string	With the `email` scope.
email_verified	boolean	With the `email` scope.
name	string	With the `profile` scope, when set.
given_name	string
middle_name	string
family_name	string
preferred_username	string

JSONExample

"sub""schemavaults-auth|8f1c2d3e-..."

"email""string"

"email_verified"true

"name""string"

"given_name""string"

"middle_name""string"

"family_name""string"

"preferred_username""string"

Example request

bashcurl

curl -X GET 'https://auth.schemavaults.com/api/oidc/userinfo'

Other methods on this path

POSTUserinfo endpoint (POST)

Authentication & permissionsPublic

Responses

200The claims the token's scope permits

401No Authorization header (invalid_request, challenge Bearer), or the bearer token is malformed, not a userinfo-audience token, expired, revoked or belongs to a disabled account (invalid_token)

403The token is valid but was not granted the openid scope (insufficient_scope)

Example request

Other methods on this path