The signed-in user's claims

GET

/oauth/userinfo

curl --request GET \
  --url https://api.nsin.ir/oauth/userinfo \
  --header 'Authorization: Bearer <token>'

• Production

The OIDC UserInfo endpoint. Returns the claims the token’s scopes allow — nothing more, and nothing at all beyond sub without profile, email or phone.

The token is verified here directly: signature, expiry, the client still being active, the account still being active, and the underlying NSIN session still being live. Signing out of NSIN therefore takes this endpoint away from a relying party within the access-token lifetime.

Authorizations

• ssoAuth

Responses

200

Claims.

Media type application/json

object

sub

The NSIN user id

string

updated_at

Unix seconds of the last profile change.

integer

name

Scope profile.

string

email

Scope email.

string

email_verified

Scope email.

boolean

phone_number

Scope phone.

string

phone_number_verified

Scope phone.

boolean

admin

First-party clients only.

boolean

national_code

First-party clients with scope nsin:identity only.

string

birth_date

First-party clients with scope nsin:identity only.

string

Example ^generated

{
  "sub": "example",
  "updated_at": 1,
  "name": "example",
  "email": "example",
  "email_verified": true,
  "phone_number": "example",
  "phone_number_verified": true,
  "admin": true,
  "national_code": "example",
  "birth_date": "example"
}

401

invalid_token — missing, malformed, expired or revoked. Carries a WWW-Authenticate: Bearer header.

Media type application/json

The RFC 6749 error shape, used by the NSIN SSO endpoints only. It is deliberately different from Error: OAuth clients match on the machine error code, and only show error_description to a developer.

object

error

required

The machine-readable code.

string

error_description

A human-readable explanation. Never match on this.

string

Example

{
  "error": "invalid_grant",
  "error_description": "authorization code is invalid or expired"
}