UserInfo Endpoint

GET /oauth/oidc/userinfo

Get user information using a valid access token. Returns claims based on the scopes and claims requested during authorization.

Responses

Status	Description
`200 OK`	User information with selective disclosures. The response includes SD-JWT metadata and an array of disclosed claims based on the scopes and claims approved during authorization.
`401 Unauthorized`	Invalid or expired access token

Content type application/json

UserInfoResponse (200)

Field	Type	Required	Description
`ref`	string	no	TrueVault person reference identifier.
`iss`	string	no	Issuer identifier.
`sub`	string	no	Subject identifier — unique ID for the user.
`nbf`	integer	no	Not before timestamp (Unix epoch).
`exp`	integer	no	Expiration timestamp (Unix epoch).
`iat`	integer	no	Issued at timestamp (Unix epoch).
`jti`	string	no	Unique JWT identifier.
`_sd_alg`	string	no	Hash algorithm used for selective disclosure digests.
`disclosures`	array of object	no	Array of disclosed claims. Each item includes a salt for SD-JWT hash verification.
`disclosures[].salt`	string	no	Random salt used for SD-JWT hash computation.
`disclosures[].claim`	string	no	Claim identifier in dot-notation format: `{type}.{field}` for identity claims, or `document.{doc_type}.{field}` for document claims.
`disclosures[].value`	string	no	The disclosed value. String for most fields (e.g. `given_name`, `email`, `birth_date`). String `"true"`/`"false"` for verified flags. JSON-encoded string for `names_verified`. For `XXX.credential` claims, the value is a W3C Verifiable Credential object — see the `VerifiableCredential` schema and the `credential-disclosure` response example.
`disclosures[].validated`	boolean,string	no	Validation result if validation was requested. `true` if the disclosure matches the SD-JWT hash, `"unknown"` if no salt was available.
`disclosures_missing`	object	no	Claims that were requested but could not be fulfilled. Keys are claim identifiers.

Example 200 response

{
  "ref": "TV-USR-a1b2c3d4",
  "iss": "https://app.truevault.com.au",
  "sub": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
  "nbf": 1708646400,
  "exp": 1740182400,
  "iat": 1708646400,
  "jti": "urn:uuid:f47ac10b-58cc-4372-a567-0e02b2c3d479",
  "_sd_alg": "sha-256",
  "disclosures": [
    {
      "salt": "nYzLq3xF8vBwR2mP",
      "claim": "trueidentity.given_name",
      "value": "Jane"
    },
    {
      "salt": "kP9wXm2cTfQzN5bR",
      "claim": "trueidentity.family_name",
      "value": "Citizen"
    },
    {
      "salt": "vH7jLm4xRtWq8sYp",
      "claim": "trueidentity.birth_date",
      "value": "1990-05-15"
    },
    {
      "salt": "qN3tRk6wXcFz9mBv",
      "claim": "trueidentity.email",
      "value": "jane.citizen@example.com"
    },
    {
      "salt": "bW5yPn8cTgXq2kRm",
      "claim": "trueidentity.email_verified",
      "value": "true"
    },
    {
      "salt": "dJ4hLm7xRtWs9vYp",
      "claim": "trueidentity.phone",
      "value": "+61412345678"
    },
    {
      "salt": "fK6tNm3wXcPz8qBv",
      "claim": "trueidentity.phone_verified",
      "value": "true"
    },
    {
      "salt": "hM2yRn9cTgXp5kWm",
      "claim": "trueidentity.names_verified",
      "value": "[{\"given_name\":\"Jane\",\"family_name\":\"Citizen\",\"source\":\"PASSPORT\"}]"
    }
  ],
  "disclosures_missing": {}
}

Content type application/json

OAuthError (401)

Field	Type	Required	Description
`error`	string	no	Error code as defined in RFC 6749.
`error_description`	string	no	Human-readable error description.

Example 401 response

{
  "error": "invalid_token",
  "error_description": "The access token is expired or invalid."
}

Example request

curl --request GET \
  --url https://sandbox.truevault.com.au/oauth/oidc/userinfo