DS Server

POST /oauth/validatetoken

Endpoint

POST https://example.com/oauth/validatetoken

Description

Checks whether an access token is valid on this DS Server instance. The endpoint was added in DS Server 3.1.0.

DS Server calls this endpoint on the registered authentication servers when a request carries an access token that DS Server didn't issue itself. If an authentication server answers true, the request is granted; if it answers false or can't be reached, the request gets 401 (Unauthorized). See GET /admin/authenticationservers and Authentication Servers.

The endpoint checks only the tokens this instance issued; it doesn't forward the token to its own authentication servers. It doesn't check the expiry date of the security profile: a token of an expired profile gets true, although the endpoints of this instance refuse it with 401 (Unauthorized). The endpoint doesn't require authorization.

Examples

The following sample checks an access token.

# Request:
curl --request POST 'https://trial.dsserver.io/oauth/validatetoken' \
    --header 'Content-Type: application/json' \
    --data-raw '"nmZ80Zn2R0P2AbS149E31IUHd5aZgB9T"'

# Response:
true

Request Payload

TypeValue
StringThe access token as a JSON string (application/json), for example "nmZ80Zn2R0P2AbS149E31IUHd5aZgB9T".

Success Response

StatusDescription
200On success, the HTTP status code in the response header is 200 (OK). The response body (application/json) is true, if the token is valid, and false, if it isn't or if the body is empty.

Error Response

StatusDescription
400A 400 (Bad Request) with a problem details object (application/problem+json) is returned, if the body is not a JSON string, for example a JSON object.
415A 415 (Unsupported Media Type) with a problem details object is returned, if the body is not sent as application/json, for example as form data or plain text.