OAuth 2.0 token introspection (RFC 7662). Tells whether an access token is valid now and what it can do: its scopes, application and expiry. Authenticate with an access token of any application of your organization (Authorization: Bearer, no scope needed) and send the token to check in the body; it can be the same token. A token that is expired, revoked by deleting its application or rotating its secret, not issued by Lumana, or of another organization answers { "active": false }. Introspection does not use a token request.