Retrieve Token User Info

get

https://ironcladapp.com/oauth/userinfo

After a client application has obtained an access token, it can make a request to the /userinfo endpoint to get user-related information. The data returned include the user's ID, email, username, and other profile details along with the scopes granted to the token. The x-as-user-email / x-as-user-id headers do not redirect this endpoint for a token from the Authorization Code grant: it always describes the user the token was issued for, because a relying party would otherwise sign in whoever the header named. Client Credentials and legacy bearer tokens have no user of their own, so for those it describes the user named by the header.

Recent Requests

Time	Status	User Agent
Retrieving recent requests…

Loading…

Headers

x-as-user-email

string

Denotes the actor of the request. When used, the API will take into account this user's permissions and access. This or x-as-user-id is required when the associated token was produced from the Client Credentials grant or with legacy bearer tokens on select endpoints. A token produced from the Authorization Code grant (which is already scoped to a user) may also use this header to act as a different user in the same company, provided the token carries the identity.users.impersonate scope and the token's own user has been granted the API User Impersonation permission. A request that sends this header without both never acts as the named user; depending on the company's configuration it either proceeds as the token's own user or is rejected with a 403. More information about permissions.

x-as-user-id

string

Denotes the actor of the request. When used, the API will take into account this user's permissions and access. This or x-as-user-email is required when the associated token was produced from the Client Credentials grant or with legacy bearer tokens on select endpoints. A token produced from the Authorization Code grant (which is already scoped to a user) may also use this header to act as a different user in the same company, provided the token carries the identity.users.impersonate scope and the token's own user has been granted the API User Impersonation permission. A request that sends this header without both never acts as the named user; depending on the company's configuration it either proceeds as the token's own user or is rejected with a 403. More information about permissions.

Responses

200200

401401

404404