# POST /oauth/validatetoken

> Validate an access token issued by this DS Server instance: post it as a JSON string and get true or false, as DS Server asks its authentication servers.

- **Product:** DS Server
- **Section:** Documentation
- **Kind:** Endpoint
- **Path:** DS Server > API Reference > Web API > OAuth > /validatetoken > POST /oauth/validatetoken
- **563 words**
- **Web URL:** https://docs.textcontrol.com/ds-server/reference/web-api/oauth/validatetoken/post/
- **LLMs URL:** https://docs.textcontrol.com/ds-server/reference/web-api/oauth/validatetoken/post/llms.txt
- **LLMs-Full URL:** https://docs.textcontrol.com/ds-server/reference/web-api/oauth/validatetoken/post/llms-full.txt

---

`POST` `https://example.com/oauth/validatetoken`

### Description

Checks whether an access token is valid on this DS Server instance. The endpoint was added in DS Server 3.1.0.

DS Server calls this endpoint on the registered authentication servers when a request carries an access token that DS Server didn't issue itself. If an authentication server answers `true`, the request is granted; if it answers `false` or can't be reached, the request gets 401 (Unauthorized). See [GET /admin/authenticationservers](https://docs.textcontrol.com/ds-server/reference/web-api/administration/authenticationservers/get/llms-full.txt) and [Authentication Servers](https://docs.textcontrol.com/ds-server/administration/authentication-servers/llms-full.txt).

The endpoint checks only the tokens this instance issued; it doesn't forward the token to its own authentication servers. It doesn't check the expiry date of the security profile: a token of an expired profile gets `true`, although the endpoints of this instance refuse it with 401 (Unauthorized). The endpoint doesn't require authorization.

### Examples

The following sample checks an access token.

```bash
# Request:
curl --request POST 'https://trial.dsserver.io/oauth/validatetoken' \
    --header 'Content-Type: application/json' \
    --data-raw '"nmZ80Zn2R0P2AbS149E31IUHd5aZgB9T"'

# Response:
true
```

### Request Payload

| Type | Value |
|---|---|
| String | The access token as a JSON string (`application/json`), for example `"nmZ80Zn2R0P2AbS149E31IUHd5aZgB9T"`. |

### Success Response

| Status | Description |
|---|---|
| 200 | On success, the HTTP status code in the response header is 200 (OK). The response body (`application/json`) is `true`, if the token is valid, and `false`, if it isn't or if the body is empty. |

### Error Response

| Status | Description |
|---|---|
| 400 | A 400 (Bad Request) with a problem details object (`application/problem+json`) is returned, if the body is not a JSON string, for example a JSON object. |
| 415 | A 415 (Unsupported Media Type) with a problem details object is returned, if the body is not sent as `application/json`, for example as form data or plain text. |

---

## Nearby

- **Previous:** [/oauth/validatetoken](https://docs.textcontrol.com/ds-server/reference/web-api/oauth/validatetoken/llms-full.txt)
- **Next:** [/oauth/test](https://docs.textcontrol.com/ds-server/reference/web-api/oauth/test/llms-full.txt)