# Introspection

Determine the active state of an OAuth 2.0 token and obtain meta-information about it (see [OAuth 2.0 Token Introspection — RFC 7662](https://www.rfc-editor.org/rfc/rfc7662)). The endpoint requires client authentication and returns `{ active: false }` for any token that is unknown, expired, or revoked.

Endpoint: POST /oidc/token/introspection

## Request fields (application/x-www-form-urlencoded):

  - `client_id` (string)
    Client ID. May also be supplied via `Authorization: Basic` or a `client_assertion` (JWT). Required when the client is configured with `client_secret_post`.

  - `client_secret` (string)
    Client secret. Required when the client is configured with `client_secret_post`.

  - `token` (string, required)
    The token to introspect (access token or refresh token).

  - `token_type_hint` (string)
    Hint about the type of token submitted for introspection.
    Enum: "access_token", "refresh_token"

## Response 200 fields (application/json):

  - `active` (boolean, required)
    Always `false`.
    Enum: false

  - `active` (boolean, required)
    Enum: true

  - `sub` (string)
    Subject — user identifier the token was issued for.

  - `client_id` (string)
    Client ID the token was issued to.

  - `scope` (string)
    Space-delimited list of scopes granted to the token.

  - `exp` (integer)
    Expiration timestamp (seconds since Unix epoch).

  - `iat` (integer)
    Issuance timestamp (seconds since Unix epoch).

  - `iss` (string)
    Token issuer.

  - `jti` (string)
    Unique identifier of the token.

  - `sid` (string)
    Session identifier the token was issued from. Present when the token is bound to a user session.

  - `token_type` (string)
    Enum: "Bearer"

  - `tid` (string)
    Tenant identifier.

  - `app_id` (string)
    Application identifier.

  - `app_name` (string)
    Application display name.

  - `roles` (array)
    Roles assigned to the user.

  - `ts_roles` (array)
    Transmit Security platform roles assigned to the user.

  - `permissions` (array)
    Permissions assigned to the user. Present when permission claims were issued onto the token.

  - `ts_permissions` (array)
    Transmit Security platform permissions assigned to the user. Present when these claims were issued onto the token.

## Response 400 fields (application/json):

  - `message` (array, required)
    Example: Bad request

  - `error_code` (number, required)
    Example: 400

## Response 500 fields (application/json):

  - `message` (string, required)
    Example: Something went wrong - Internal server error

  - `error_code` (number, required)
    Example: 500