Skip to main content
POST
Introspect an opaque access token

Authorizations

Authorization
string
header
required

Use client_id as username and client_secret as password for confidential server-side calls. The application allowed_scopes still gate each /v2 endpoint; never use this secret in browsers, mobile apps, logs, or query strings. Server integrations may alternatively send x-client-id and x-client-secret headers (the legacy x-invoiceedge-* names remain accepted).

Body

application/x-www-form-urlencoded
token
string
required
token_type_hint
enum<string>
Available options:
access_token

Response

200 - application/json

Token activity and metadata.

active
boolean
required
scope
string
client_id
string
token_type
string
exp
integer
sub
string
tenant_id
string<uuid>