openapi: 3.0.3
info:
  title: Mastercard Developer Hub for FDX APIs FDX Authorization Server Application Check Controller Token Introspection API
  version: 1.0.0
  description: Dynamic Client Registration, Token, Introspection, Authorize API
  contact:
    name: API Support
    email: apisupport@mastercard.com
    url: https://developer.mastercard.com/support
servers:
- url: http://localhost:8080
  description: Localhost URL
tags:
- name: Token Introspection
  description: API to check whether the OAuth Token is currently active.
paths:
  /oauth2/introspect:
    post:
      tags:
      - Token Introspection
      summary: Mastercard Developer Hub for FDX APIs Token Introspection Endpoint
      description: This endpoint allows clients to validate an access token and retrieve its metadata, such as its validity, scopes, and associated user details.
      operationId: introspectionToken
      requestBody:
        $ref: '#/components/requestBodies/IntrospectRequestBody'
      responses:
        '200':
          $ref: '#/components/responses/Introspect'
      security:
      - {}
components:
  schemas:
    client_id:
      type: string
      example: dh-fdx-client-registrar-2
      description: OAuth 2.0 client identifier.  Unique ID representing Data Recipient and Identity Chain combination
    TokenIntrospection:
      type: object
      properties:
        active:
          type: boolean
          description: Indicates whether the token is active or not.
          example: true
        sub:
          type: string
          description: The subject of the token.
          example: fdxuser
        aud:
          type: array
          items:
            type: string
          description: The audience of the token.
          example:
          - dh-fdx-client-registrar-2
        nbf:
          type: number
          description: Identifies the time (a timestamp in seconds) before which the token must not be accepted for processing.
          example: 1722333643
        scope:
          type: string
          description: A space-delimited list of scopes.
          example: fdx:transactions:read
        iss:
          type: string
          description: The issuer of the token.
          example: http://localhost:8080
        exp:
          type: number
          description: The expiration time of the token in seconds
          example: 1722333943
        iat:
          type: number
          description: The issuing time of the token in seconds
          example: 1722333643
        jti:
          type: string
          description: The identifier of the token.
          example: 10c56f8c-956c-4830-99f1-c66080c589d2
        client_id:
          type: string
          description: The ID of the client associated with the token.
          example: dh-fdx-client-registrar-2
        token_type:
          type: string
          description: The type of token.
          example: Bearer
  requestBodies:
    IntrospectRequestBody:
      required: true
      content:
        application/x-www-form-urlencoded:
          schema:
            type: object
            properties:
              client_assertion:
                type: string
                example: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
                description: The encoded assertion JWT.
              client_assertion_type:
                type: string
                example: urn:ietf:params:oauth:client-assertion-type:jwt-bearer
                description: This MUST be set to urn:ietf:params:oauth:client-assertion-type:jwt-bearer
              client_id:
                $ref: '#/components/schemas/client_id'
              token:
                type: string
                example: Oki4J36pUhrrQvdLOy8_IqXSdELszmp2VbZ0bNJqAoLSFXIn633SjltVgxQoTZ84bWXnom66AkRFdtVr8HOqi3yaYxCZ-6niRNe00ygCF_o0Ky6upoZWJ
                description: Token to be introspected
              token_type_hint:
                type: string
                example: refresh_token
                description: Indicates the type of token being passed. Valid values are access_token, id_token, refresh_token, and device_secret.
          examples:
            Introspection - AccessToken:
              value:
                client_assertion: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
                client_assertion_type: urn:ietf:params:oauth:client-assertion-type:jwt-bearer
                client_id: dh-fdx-client-registrar-2
                token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
                token_type_hint: access_token
            Introspection - RefreshToken:
              value:
                client_assertion: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
                client_assertion_type: urn:ietf:params:oauth:client-assertion-type:jwt-bearer
                client_id: dh-fdx-client-registrar-2
                token: Oki4J36pUhrrQvdLOy8_IqXSdELszmp2VbZ0bNJqAoLSFXIn633SjltVgxQoTZ84bWXnom66AkRFdtVr8HOqi3yaYxCZ-6niRNe00ygCF_o0Ky6upoZWJ
                token_type_hint: refresh_token
  responses:
    Introspect:
      description: Introspection response as per token type
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/TokenIntrospection'
          examples:
            Successful response:
              value:
                active: true
                sub: dh-fdx-client-registrar-2
                aud:
                - dh-fdx-client-registrar-2
                nbf: 1720612247
                scope: client.read
                iss: http://localhost:8080
                exp: 1720612547
                iat: 1720612247
                jti: b39bf7e9-92ae-4649-a1f0-87983285fe1
                client_id: dh-fdx-client-registrar-2
                token_type: Bearer
            Invalid client_assertion:
              value:
                active: false
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer