Access tokens are credentials used to access protected resources. An access token is a string representing an authorization issued to the client. The string is usually opaque to the client. Tokens represent specific scopes and durations of access, granted by the resource owner, and enforced by the resource server and authorization server.

The access token type provides the client with the information required to successfully utilize the access token to make a protected resource request (along with type-specific attributes). The client MUST NOT use an access token if it does not understand the token type.

Refresh tokens are credentials used to obtain access tokens. Refresh tokens are issued to the client by the authorization server and are used to obtain a new access token when the current access token becomes invalid or expires, or to obtain additional access tokens with identical or narrower scope (access tokens may have a shorter lifetime and fewer permissions than authorized by the resource owner). Issuing a refresh token is optional at the discretion of the authorization server.

refresh token issued timestamp

The lifetime in seconds of the access token. For example, the value "3600" denotes that the access token will expire in one hour from the time the response was generated. If omitted, the authorization server SHOULD provide the expiration time via other means or document the default value

The authorization and token endpoints allow the client to specify the scope of the access request using the "scope" request parameter. In turn, the authorization server uses the "scope" response parameter to inform the client of the scope of the access token issued.

refresh token last update timestamp

current token expire seconds

A URI reference [RFC3986] that identifies the problem type.

A short, human-readable summary of the problem type.

A human-readable explanation specific to this occurrence of the problem.

A URI reference that identifies the specific occurrence of the problem. It may or may not yield further information if dereferenced.

Message identification for searching errors

Message codes defined for AIS for appropriate HTTP status code

A URI reference [RFC3986] that identifies the problem type.

A short, human-readable summary of the problem type.

A human-readable explanation specific to this occurrence of the problem.

A URI reference that identifies the specific occurrence of the problem. It may or may not yield further information if dereferenced.

Message identification for searching errors

Message codes defined for AIS for appropriate HTTP status code