Read JSON metadata with its actual types
03The response is an application/json object. active is a required JSON Boolean; most other fields are optional context and must be interpreted with their specified types.
The aud member can be a string or array of strings. Its optional presence is separate from the server’s required applicable audience check.
Source for this drawing: RFC 7662 · Read RFC section 2.2 ↗
New to this? Start hereA quick picture + helpful background
A message needs an address.
Think of a packet as a small addressed envelope. Devices pass it onward; transport protocols decide what delivery promises an application gets.
Helpful first, if these ideas are unfamiliar
These pictures are analogies to help you learn. The linked RFC explains the actual rules.
Terms in this drawing
- NumericDate
- A timestamp measured in seconds since the Unix epoch, with the integer type specified here.
- Claim
- A named piece of information in the JSON response.
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
active is REQUIRED and has Boolean value true or false, not the strings true/false. Its meaning depends on the authorization server and applicable checks.
- active is REQUIRED and has Boolean value true or false, not the strings true/false. Its meaning depends on the authorization server and applicable checks.
- scope is an OPTIONAL space-separated string. client_id, username, token_type, sub, iss and jti are OPTIONAL strings; aud is an OPTIONAL string or array of strings.
- exp, iat and nbf are OPTIONAL integer timestamps in seconds since1970-01-01 UTC, not milliseconds. An active response need not contain every optional claim.
- Service-specific top-level extensions MAY be defined. Response names intended for use across domains MUST be registered in the introspection response registry; verified erratum4764 corrects the registry’s description.
Fictional JSON examples are complete objects, with display-only line breaks. The example exp2000000060 is a chosen NumericDate, not a live token timestamp. Optional information is not guaranteed and is not equivalent to a successful API authorization decision. A token need not be a JWT for introspection to return JWT-defined metadata names. A standard JSON response here is not itself a signed JWT response.
Read the RFC section ↗