Token introspection

Introspecting a token

Introspection verifies the token you present and echoes back its principal — useful for debugging scope issues or confirming what a token can do before wiring it into an integration. Send the token to introspect as the request's own bearer credential:

curl -X POST https://api.onlucra.com/v1/auth/introspect \
  -H "Authorization: Bearer $LUCRA_API_TOKEN"

A valid token returns active: true with the decoded principal — subject, actor, any bound organization or creator, the granted scopes, and the issue/expiry timestamps:

{
  "data": {
    "active": true,
    "principal": {
      "actor": "brand",
      "subject": "api_key_123",
      "organizationId": "org_...",
      "scopes": ["brand:programs:read", "brand:submissions:review"],
      "issuedAt": "2026-07-01T12:00:00.000Z",
      "expiresAt": "2026-07-01T13:00:00.000Z"
    }
  },
  "ok": true
}

An invalid, expired, or wrong-audience token returns 401 unauthorized rather than an inactive-token payload, so any non-200 response means the token cannot be used.