nsindocs Search the docs⌘K
API
  1. Docs
  2. API reference
  3. SSO

The signed-in user's claims

gethttps://api.nsin.ir/oauth/userinfo

Auth: SSO access token — see API keys.

The OIDC UserInfo endpoint. Returns the claims the token's scopes allow — nothing more, and nothing at all beyond sub without profile, email or phone.

The token is verified here directly: signature, expiry, the client still being active, the account still being active, and the underlying NSIN session still being live. Signing out of NSIN therefore takes this endpoint away from a relying party within the access-token lifetime.

Responses

200Claims.

Content type: application/json

  • substring

    The NSIN user id, as a decimal string.

  • updated_atinteger

    Unix seconds of the last profile change.

  • namestring

    Scope profile.

  • emailstring

    Scope email.

  • email_verifiedboolean

    Scope email.

  • phone_numberstring

    Scope phone.

  • phone_number_verifiedboolean

    Scope phone.

  • adminboolean

    First-party clients only.

  • national_codestring

    First-party clients with scope nsin:identity only.

  • birth_datestring

    First-party clients with scope nsin:identity only.

json
{
  "sub": "string",
  "updated_at": 0,
  "name": "string",
  "email": "string",
  "email_verified": true,
  "phone_number": "string",
  "phone_number_verified": true,
  "admin": true,
  "national_code": "string",
  "birth_date": "string"
}
401invalid_token — missing, malformed, expired or revoked. Carries a WWW-Authenticate: Bearer header.

Content type: application/json

  • errorstringrequired

    The machine-readable code.

  • error_descriptionstring

    A human-readable explanation. Never match on this.

json
{
  "error": "invalid_grant",
  "error_description": "authorization code is invalid or expired"
}

Example request

bash
curl -X GET "https://api.nsin.ir/oauth/userinfo" \
  -H "Authorization: Bearer $NSIN_API_KEY"
esc