<authentication-url path="https://accounts.travel_bureau.com/oauth/user/info">
    <operation method="get" name="Check Access Token" category="action">
        <response status="200">
            <content>
                <encode type="application/json" />
                <structure name="user info">
                    <property name="First_Name" type="string" />
                    <property name="Last_Name" type="string" />
                    <property name="Display_Name" type="string" />
                    <property name="ZUID" type="long" />
                    <property name="Email" type="string" />
                </structure>
            </content>
        </response>
    </operation>
</authentication-url>

 
<authentication-url path="https://authorization-server.com/token-info">
    <description>The token introspection endpoint will return information about a token</description>
    <operation method="post" name="IntrospectToken" category="action">
        <request-body>
            <content>
                <encode type="text/plain" />
                <structure name="Token">
                    <property name="token" type="string"/>
                </structure>
            </content>
        </request-body>
        <response status="200">
            <content>
                <encode type="application/json" />
                <structure-group type="one-of">
                    <structure name="TokenInfo">
                        <property name="active" type="boolean" values="true"/>
                        <property name="scopes" type="string"/>
                        <property name="client_id" type="string"/>
                        <property name="expires_at" type="datetime"/>
                    </structure>
                    <structure name="ExpiredTokenResponse">
                        <property name="active" type="boolean" values="false"/>
                    </structure>
                </structure-group>
            </content>
        </response>
        <response status="401">
            <content>
                <encode type="application/json" />
                <structure name="AuthenticationErrorResponse">
                    <property name="code" type="string" values="INVALID_CLIENT"/>
                    <property name="message" type="string"/>
                    <property name="status" type="string" values="error"/>
                </structure>
            </content>
        </response>
    </operation>
</authentication-url>