Which OAuth2 web endpoint is used to validate a token?

While several endpoints in PingAM 8.0.2 interact with tokens, only one is explicitly designed for the purpose of checking the metadata and validity of an opaque or structured OAuth2 token.

According to the "OAuth 2.0 Endpoints" and "Token Introspection" documentation:

/oauth2/introspect (Option B): This is the RFC 7662-compliant endpoint. It is used by resource servers (or other authorized clients) to determine the "activeness" of a token. When a token is sent to this endpoint, PingAM returns a JSON object indicating if the token is valid, its scope, its expiration time, and the subject it represents. This is the standard way to validate tokens that are not self-validated (like opaque tokens stored in the CTS).

Why other options are incorrect:

/oauth2/userinfo (Option A): This endpoint is part of OpenID Connect. While itrequiresa valid token to function, its purpose is to return user claims, not to provide a "valid/invalid" metadata check of the token itself.

/oauth2/validate (Option C): This is a legacy endpoint used in older versions of the product. In PingAM 8.0.2, introspection is the standardized replacement.

/oauth2/access_token (Option D): This is theToken Endpointused toissuetokens, not to validate them.

Using the/oauth2/introspectendpoint is a best practice for security because it allows the authorization server (PingAM) to verify that a token has not been revoked in the Core Token Service (CTS) before a resource server grants access.