This endpoint is used by protected resources to query information about an OAuth 2.0 token.

Usage

• Accepts a token in the request body.
• Returns metadata including active, client_id, exp, scope, etc.
• If the token is not recognised or has expired, active will be false.

Security

• Requires Basic authentication using a registered OAuth client's credentials.

Endpoint Protection:

• HarborBasicTokenAuthGuard: Refer to guard documentation for details.

Examples:

• Introspect a valid token: Returns active: true if token is valid and not expired.

{
  "token": "SlAV32hkKG"
}

• Introspect an expired token: Returns active: false if token is expired or revoked.

{
  "token": "expiredTokenValue"
}