Mastercard Developer Hub for FDX APIs

Mastercard Developer Hub for FDX APIs Token Introspection API

API to check whether the OAuth Token is currently active.

Documentation GitHub OpenAPI

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this

find_apisBrowse and filter every API in the catalog.
get_api_artifactsOne API's artifacts, grouped by type.
get_openapiThe primary OpenAPI for this API.
find_similar_apisAPIs that look like this one.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools

Call it yourself

curl for this page

This API

curl "https://apis.io/api/v1/apis/mastercard-developer-hub-for-fdx-apis-token-introspection-api"

All apis

curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no email required.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

openapi: 3.0.3
info:
  title: Mastercard Developer Hub for FDX APIs FDX Authorization Server Application Check Controller Token Introspection API
  version: 1.0.0
  description: Dynamic Client Registration, Token, Introspection, Authorize API
  contact:
    name: API Support
    email: apisupport@mastercard.com
    url: https://developer.mastercard.com/support
servers:
- url: http://localhost:8080
  description: Localhost URL
tags:
- name: Token Introspection
  description: API to check whether the OAuth Token is currently active.
paths:
  /oauth2/introspect:
    post:
      tags:
      - Token Introspection
      summary: Mastercard Developer Hub for FDX APIs Token Introspection Endpoint
      description: This endpoint allows clients to validate an access token and retrieve its metadata, such as its validity, scopes, and associated user details.
      operationId: introspectionToken
      requestBody:
        $ref: '#/components/requestBodies/IntrospectRequestBody'
      responses:
        '200':
          $ref: '#/components/responses/Introspect'
      security:
      - {}
components:
  schemas:
    client_id:
      type: string
      example: dh-fdx-client-registrar-2
      description: OAuth 2.0 client identifier.  Unique ID representing Data Recipient and Identity Chain combination
    TokenIntrospection:
      type: object
      properties:
        active:
          type: boolean
          description: Indicates whether the token is active or not.
          example: true
        sub:
          type: string
          description: The subject of the token.
          example: fdxuser
        aud:
          type: array
          items:
            type: string
          description: The audience of the token.
          example:
          - dh-fdx-client-registrar-2
        nbf:
          type: number
          description: Identifies the time (a timestamp in seconds) before which the token must not be accepted for processing.
          example: 1722333643
        scope:
          type: string
          description: A space-delimited list of scopes.
          example: fdx:transactions:read
        iss:
          type: string
          description: The issuer of the token.
          example: http://localhost:8080
        exp:
          type: number
          description: The expiration time of the token in seconds
          example: 1722333943
        iat:
          type: number
          description: The issuing time of the token in seconds
          example: 1722333643
        jti:
          type: string
          description: The identifier of the token.
          example: 10c56f8c-956c-4830-99f1-c66080c589d2
        client_id:
          type: string
          description: The ID of the client associated with the token.
          example: dh-fdx-client-registrar-2
        token_type:
          type: string
          description: The type of token.
          example: Bearer
  requestBodies:
    IntrospectRequestBody:
      required: true
      content:
        application/x-www-form-urlencoded:
          schema:
            type: object
            properties:
              client_assertion:
                type: string
                example: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
                description: The encoded assertion JWT.
              client_assertion_type:
                type: string
                example: urn:ietf:params:oauth:client-assertion-type:jwt-bearer
                description: This MUST be set to urn:ietf:params:oauth:client-assertion-type:jwt-bearer
              client_id:
                $ref: '#/components/schemas/client_id'
              token:
                type: string
                example: Oki4J36pUhrrQvdLOy8_IqXSdELszmp2VbZ0bNJqAoLSFXIn633SjltVgxQoTZ84bWXnom66AkRFdtVr8HOqi3yaYxCZ-6niRNe00ygCF_o0Ky6upoZWJ
                description: Token to be introspected
              token_type_hint:
                type: string
                example: refresh_token
                description: Indicates the type of token being passed. Valid values are access_token, id_token, refresh_token, and device_secret.
          examples:
            Introspection - AccessToken:
              value:
                client_assertion: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
                client_assertion_type: urn:ietf:params:oauth:client-assertion-type:jwt-bearer
                client_id: dh-fdx-client-registrar-2
                token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
                token_type_hint: access_token
            Introspection - RefreshToken:
              value:
                client_assertion: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
                client_assertion_type: urn:ietf:params:oauth:client-assertion-type:jwt-bearer
                client_id: dh-fdx-client-registrar-2
                token: Oki4J36pUhrrQvdLOy8_IqXSdELszmp2VbZ0bNJqAoLSFXIn633SjltVgxQoTZ84bWXnom66AkRFdtVr8HOqi3yaYxCZ-6niRNe00ygCF_o0Ky6upoZWJ
                token_type_hint: refresh_token
  responses:
    Introspect:
      description: Introspection response as per token type
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/TokenIntrospection'
          examples:
            Successful response:
              value:
                active: true
                sub: dh-fdx-client-registrar-2
                aud:
                - dh-fdx-client-registrar-2
                nbf: 1720612247
                scope: client.read
                iss: http://localhost:8080
                exp: 1720612547
                iat: 1720612247
                jti: b39bf7e9-92ae-4649-a1f0-87983285fe1
                client_id: dh-fdx-client-registrar-2
                token_type: Bearer
            Invalid client_assertion:
              value:
                active: false
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer

Mastercard Developer Hub for FDX APIs Token Introspection API

Documentation

Specifications

SDKs

Other Resources