POST/api/oidc/introspectPublic

Token introspection

The OAuth 2.0 token introspection endpoint (RFC 7662), advertised as introspection_endpoint. A confidential client POSTs an access or refresh token issued by this server and learns whether it is currently active plus its metadata (scope, client, subject, expiry). Tokens minted for other resource-API audiences, tokens issued to a different client, expired and revoked tokens all yield { "active": false }. Public (PKCE-only) clients cannot introspect: without client authentication the endpoint would be open to token scanning. Responses carry Cache-Control: no-store and Access-Control-Allow-Origin: *.

operationId post_api_oidc_introspectOpenID Connect / OAuth 2.0

Authentication & permissionsPublic

Anyone — no credentials required

Accepted credentials
None required
Notes
Client authentication is REQUIRED (RFC 7662 §2.1): client_secret_basic (HTTP Basic Authorization header) or client_secret_post (client_secret form field) of an app with a registered client secret. The handler performs this itself; none is not accepted.

Request body

Required

application/x-www-form-urlencoded
OidcIntrospectionRequest
PropertyTypeDescription
token*string

REQUIRED. The access or refresh token to introspect.

token_type_hint"access_token" | "refresh_token"

Accepted but unused: the token kind is read from the token itself.

client_idstring

The confidential client's id; may be omitted with client_secret_basic.

minLength: 2maxLength: 64pattern: ^[a-z0-9_-]*$

client_secretstring

client_secret_post authentication.

Responses

HeaderTypeDescription
Cache-Controlstring
application/json
OidcIntrospectionResponse

RFC 7662 §2.2 introspection response.

JSONExample
"active"false

Example request

bashcurl
curl -X POST 'https://auth.schemavaults.com/api/oidc/introspect' \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  --data-urlencode 'token=string' \
  --data-urlencode 'token_type_hint=access_token' \
  --data-urlencode 'client_id=string' \
  --data-urlencode 'client_secret=string'