Introspect OIDC token
POST/api/oidc/:OIDCAppName/introspect
Returns the active state and metadata of an OIDC access or refresh token per RFC 7662 (OAuth 2.0 Token Introspection). The client must authenticate using either HTTP Basic authentication (Authorization: Basic base64(client_id:client_secret)) or by including client_id and client_secret in the POST body, depending on the token_endpoint_auth_method configured for the OIDC application. Returns active: true with associated claims for valid tokens, or active: false for invalid, expired, or revoked tokens.
Request
Responses
- 200
- 400
- 401
- 403
OK: Introspection result (active true with claims, or active false).
Status Bad Request: The request could not be understood by the server due to malformed syntax.
Status Unauthorized: The client must authenticate itself to get the requested response.
Status Forbidden: The client does not have permission to access the resource.