callTokenIntrospection
fun callTokenIntrospection(oauthMetadata: OAuth2AuthorizationServerMetadata, request: TokenIntrospectionRequest, popAudience: String, issuerMetadata: IssuerMetadata? = null): HttpExchange<TokenIntrospectionResponse>(source)
Calls the token introspection endpoint (OAuth2AuthorizationServerMetadata.introspectionEndpoint) to check whether the given token is active, finishes with the response on success, otherwise fails with InvalidToken. With verifyTokenIntrospectionJwt, it asks for a JWT response (RFC 9701 4.), and accepts it only with typ token-introspection+jwt, a verified signature, the authorization server as iss, and the client_id of oAuth2Client in aud (RFC 9701 5.).
Sends ([AttestationChallenge] TokenIntrospection){1,3}.