# User info endpoint

Documentation owner: product `access`; documentation version: `3.9.1`.
Source: `content/products/access/3.9.1/key-components/modules/oidc/user-info-endpoint.md` at commit `eaf7a020437971baeee95e87eaf963636040ac71`.

An access token should normally be included in the HTTP Authorization header.

(Authorization: Bearer \<access\_token>)

```
Example: http://127.0.0.1:8080/oidc/tenant1/userinfo-endpoint
```

If a client cannot use the Authorization header, the UserInfo endpoint can also accept `access_token` as a query parameter, but only when the OIDC module property `allow_userinfo_access_token_in_query` is explicitly set to `true`.

This is disabled by default and should only be used for legacy compatibility.

The access token used with the UserInfo endpoint must represent OIDC access and include the `openid` scope.

For newly issued opaque access tokens, FortifiedID Integrity persists the granted `scope` together with the token session and uses that when evaluating UserInfo requests. JWT access tokens should also carry the granted `scope`.

## Claim expansion

When `userinfo_claims` uses expansion expressions such as `${exports.email}`, unresolved export values are returned as empty claim values. Access does not return the unresolved expression string to the client.

For example, if `userinfo_claims` contains `"email": "${exports.email}"` and `exports.email` is not available, the UserInfo response contains `"email": ""`.

#### User info endpoint errors

| Error id             | Description                                                            |
| -------------------- | ---------------------------------------------------------------------- |
| `invalid_request`    | The request is NOT valid. This is usually due to missing access token. |
| `invalid_token`      | The provided access token has timed out.                               |
| `insufficient_scope` | The access token does not include the required `openid` scope.         |