API referenceOAuthIntrospect a token

Introspect a token

⚠️
Preview — this feature is being built; the design below is the spec.
POST https://app.syntic.ai/v1/oauth/introspect

Ask whether a Syntic access or refresh token is still active and what it may do, following RFC 7662. Confidential apps use it on their servers to validate tokens they receive from their own front end. Authenticate with the app’s client id and secret.

For how this fits into a full workflow, see Build a Sign in with Syntic app.

Headers

HeaderRequiredValue
syntic-betaYes, while in previewoauth-apps-2026-12-01. Without it the call fails with 400 beta_required. See Versioning.
Content-TypeYesapplication/json

Body parameters

ParameterTypeRequiredNotes
tokenstringYes
token_type_hintstringNoaccess_token or refresh_token.
client_idstringYes
client_secretstringYes

Response

200 OK, Content-Type: application/json

{
  "active": true,
  "client_id": "oapp_01JD79H1K3M5P7R9T1V3",
  "sub": "user_01J9Y0A2C4E6G8J0L2N4",
  "scope": "user:profile user:inference",
  "exp": 1793872800,
  "iat": 1793869200,
  "token_type": "access_token"
}
FieldTypeDescription
activebooleanfalse for expired, revoked, unknown, or another app’s tokens. Nothing else is returned then.

Examples

curl -sS "https://app.syntic.ai/v1/oauth/introspect" \
  -H "syntic-beta: oauth-apps-2026-12-01" \
  -H "Content-Type: application/json" \
  -d '{
      "token": "sat_…",
      "token_type_hint": "access_token",
      "client_id": "oapp_01JD79H1K3M5P7R9T1V3",
      "client_secret": "scs_live_…"
    }'

Errors

Errors use the error envelope and carry a request_id. Codes specific to this operation:

StatustypecodeWhen
400invalid_request_errorbeta_requiredThe syntic-beta header is missing.
401authentication_errorinvalid_clientWrong client id or secret.
429rate_limit_errorrate_limitedToo many requests; wait for Retry-After. See Rate-limit headers.

This endpoint also accepts application/x-www-form-urlencoded bodies, as RFC 7662 describes. The Authorization header is not used; the client credentials in the body authenticate the call.

Was this page helpful?