Introspect is a standard endpoint mainly used by Resource Servers to determine the particuar authorization context for an Access Token. A Resource Server may need such information to validate incomming tokens before granting access to Proteted Resources it hosts.
As the Access Tokens used by the OIDC Provider from BankID are self-contained most of the validation process can be performed without calling the Introspection endpoint. There are however two reasons for still using introspect:
- To check if the token has not been revoked for any reason prior to the expiry time that is embedded in the token itself
- To get access to confidential claims that are not contained in the access token itself. The
bankid_altsubis one such example
Using introspect also simplifies the validation process for the OIDC Client by leaving all self-contained checks to the OIDC Provider.
Note that the OIDC Provider from BankID does not support introspection of Refresh Tokens.
|OIDC/OAuth2 client authentication according to supported methods
200 OK with JSON containing response elements
The recommended practise for merchants is to use the Introspect URL from openid-configuration rather than hardcoding the below URL value.
|JWT value of the token subject to introspection
|Must contain the value
bid_access_token to signify that the Access Token in question is of the type supported by the OIDC Provider from BankID
The response is a JSON structure containing the same claims as those contained in the JWT Access Token subject to introspection. The following additional claims that are specific for the introspection response are also included:
|Indicator of whether or not the presented token is currently active
|Identifier of the OIDC client that requested the token
|See ID Token. This claim may be returned via introspection to eligible resources servers regardless of any such claim returned in the ID Token to the OIDC client in question