POST/api/oidc/userinfoPublic

Userinfo endpoint (POST)

The OpenID Connect userinfo endpoint (OIDC Core §5.3). Presents the access token issued by the token endpoint as Authorization: Bearer <access_token>; the server decrypts and verifies it (only tokens minted for the reserved oidc-userinfo audience are accepted) and returns the claims permitted by the token's granted scope: sub always, email / email_verified with the email scope, and the profile name claims (read fresh from the user's profile) with the profile scope. Tokens from a plain OAuth 2.1 grant (no openid scope) are refused with 403 insufficient_scope. Served with Access-Control-Allow-Origin: * and Cache-Control: no-store. OIDC Core §5.3.1 allows POST as well as GET; form-body token delivery is not supported (the token must be in the Authorization header).

operationId post_api_oidc_userinfoOpenID Connect / OAuth 2.0

Authentication & permissionsPublic

Anyone — no credentials required

Accepted credentials
None required
Notes
Bearer access token minted by POST /api/oidc/token for the reserved oidc-userinfo audience (RFC 6750 §2.1). The handler verifies it itself; the platform's session cookies are not accepted here.

Responses

HeaderTypeDescription
Cache-Controlstring
application/json
OidcUserinfoClaimsOIDC Core §5.3.2 claims, filtered by the access token's granted scope.
PropertyTypeDescription
sub*string

Subject identifier in the <auth_server_app_id>|<uid> form; always present and identical to the id_token's sub.

emailstring

With the email scope.

email_verifiedboolean

With the email scope.

namestring

With the profile scope, when set.

given_namestring
middle_namestring
family_namestring
preferred_usernamestring
JSONExample
"sub""schemavaults-auth|8f1c2d3e-..."
"email""string"
"email_verified"true
"name""string"
"given_name""string"
"middle_name""string"
"family_name""string"
"preferred_username""string"

Example request

bashcurl
curl -X POST 'https://auth.schemavaults.com/api/oidc/userinfo'

Other methods on this path