Skip to content

Commit

Permalink
Update introspection doc
Browse files Browse the repository at this point in the history
  • Loading branch information
Roland Guijt committed Oct 22, 2024
1 parent b881727 commit b998244
Showing 1 changed file with 11 additions and 4 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ weight: 5

The introspection endpoint is an implementation of [RFC 7662](https://tools.ietf.org/html/rfc7662).

It can be used to validate reference tokens (or JWTs if the consumer does not have support for appropriate JWT or cryptographic libraries).
It can be used to validate reference tokens, JWTs (if the consumer does not have support for appropriate JWT or cryptographic libraries) and refresh tokens. The response will contain the claims in the token.
The introspection endpoint requires authentication - since the client of an introspection endpoint is an API, you configure the secret on the *ApiResource*.

```
Expand All @@ -16,16 +16,23 @@ Authorization: Basic xxxyyy
token=<token>
```

A successful response will return a status code of 200 and either an active or inactive token::
A successful response will return a status code of 200, the token claims, the token type and a flag indicating either an active or inactive token:

```
{
"iss": "https://localhost:5001",
"nbf": 1729599599,
"iat": 1729599599,
"exp": 1729603199,
"client_id": "client",
"jti": "44FD2DE9E9F8E9F4DDD141CD7C244BE9",
"scope": "api1"
"token_type": "access_token",
"active": true,
"sub": "123"
}
```

Unknown or expired tokens will be marked as inactive::
Unknown or expired tokens will be marked as inactive:

```
{
Expand Down

0 comments on commit b998244

Please sign in to comment.