Skip to main content
Authorisation Server

Validate access token

POST/v4/service/consent/data-space/validate-access

Checks an access token that a data using service sent to the API of your organisation, the data source, and decides whether the call is allowed. Call it from your API before you answer a data using service.

The call is allowed (verified: true) when all of these are true:

  • Your organisation issued the token, and its signature, issuer and audience are valid.
  • The data disclosure agreement record in the token exists, both parties signed it and it is opted in.
  • httpMethod and path match an operation in the OpenAPI specification of the template of the record.
  • For a pii token: the individual in the token exists in your organisation with the externalIdType personNumber, and opted in to your data agreement.

For an anonymous token, individuals lists all individuals who opted in to the data agreement. For a pii token, it holds the one individual of the token. Use the exclude... flags to leave parts out of the answer.

When the call is not allowed, the answer is still 200, with verified: false and the reason. One case has no reason: for a pii token whose individual does not exist, does not have the externalIdType personNumber, or did not opt in, the answer has the form of an allowed call with verified: false and individuals: null. signatureVerified tells whether the token signature was valid, when the service got that far. The service logs every check as a validate access record.

Authorizations

  • Authorizationstringheaderrequired

    Your API key with the prefix ApiKey: ApiKey <your-api-key>. Get an API key.

    Scope:data-space:read

Body

application/json
  • accessTokenstringrequired

    The access token that the data using service sent.

  • httpMethodstringrequired

    The HTTP method that the data using service called, for example GET.

  • pathstringrequired

    The path that the data using service called, for example /loyalty/123456/points.

  • excludeDataClassificationboolean

    true leaves dataClassification out of the answer.

    Default:false

  • excludeIndividualsboolean

    true leaves individuals out of the answer.

    Default:false

  • excludeDecodedClaimsboolean

    true leaves decodedClaims out of the answer.

    Default:false

Response

application/json

The decision.

One of
  • bodyobject