Key introspection

Send the key as the request's bearer credential:

curl -X POST https://api.onlucra.com/v1/auth/introspect \
  -H "Authorization: Bearer $LUCRA_API_KEY"

Introspection does not require agency client selection. A valid key returns its principal:

{
  "data": {
    "active": true,
    "principal": {
      "actor": "partner",
      "ownerOrganizationId": "agency_org_id",
      "allowedClients": [
        { "id": "brand_org_id", "name": "Acme", "slug": "acme", "executionMode": "direct" }
      ],
      "scopes": ["partner:programs:read"],
      "issuedAt": "2026-08-05T12:00:00.000Z"
    }
  },
  "ok": true
}

expiresAt is omitted for a no-expiry key. Invalid, expired, or revoked keys return 401 unauthorized.