Introspect a token
⚠️
Preview — this feature is being built; the design below is the spec.
POST https://app.syntic.ai/v1/oauth/introspectAsk whether a Syntic access or refresh token is still active and what it may do, following RFC 7662. Confidential apps use it on their servers to validate tokens they receive from their own front end. Authenticate with the app’s client id and secret.
For how this fits into a full workflow, see Build a Sign in with Syntic app.
Headers
| Header | Required | Value |
|---|---|---|
syntic-beta | Yes, while in preview | oauth-apps-2026-12-01. Without it the call fails with 400 beta_required. See Versioning. |
Content-Type | Yes | application/json |
Body parameters
| Parameter | Type | Required | Notes |
|---|---|---|---|
token | string | Yes | |
token_type_hint | string | No | access_token or refresh_token. |
client_id | string | Yes | |
client_secret | string | Yes |
Response
200 OK, Content-Type: application/json
{
"active": true,
"client_id": "oapp_01JD79H1K3M5P7R9T1V3",
"sub": "user_01J9Y0A2C4E6G8J0L2N4",
"scope": "user:profile user:inference",
"exp": 1793872800,
"iat": 1793869200,
"token_type": "access_token"
}| Field | Type | Description |
|---|---|---|
active | boolean | false for expired, revoked, unknown, or another app’s tokens. Nothing else is returned then. |
Examples
curl -sS "https://app.syntic.ai/v1/oauth/introspect" \
-H "syntic-beta: oauth-apps-2026-12-01" \
-H "Content-Type: application/json" \
-d '{
"token": "sat_…",
"token_type_hint": "access_token",
"client_id": "oapp_01JD79H1K3M5P7R9T1V3",
"client_secret": "scs_live_…"
}'Errors
Errors use the error envelope and carry a request_id. Codes specific to this operation:
| Status | type | code | When |
|---|---|---|---|
| 400 | invalid_request_error | beta_required | The syntic-beta header is missing. |
| 401 | authentication_error | invalid_client | Wrong client id or secret. |
| 429 | rate_limit_error | rate_limited | Too many requests; wait for Retry-After. See Rate-limit headers. |
This endpoint also accepts application/x-www-form-urlencoded bodies, as RFC 7662 describes. The Authorization header is not used; the client credentials in the body authenticate the call.
Was this page helpful?