Token introspection

Purpose and boundary

Introspection lets server-side integrations inspect token state. It does not issue user identity and browsers must not call it with client_secret. Ordinary SDK calls do not need manual introspection first; business APIs validate credentials.

Consult the public REST contract in API Reference for required authentication and request fields. Do not treat an internal RPC as an unauthenticated OAuth endpoint. Resource servers must still verify issuer, expiry, caller identity and scopes; active does not replace endpoint authorization.

See quickstart and OAuth.