Analyses the provided access token in serialized form to infer the scope of data access the token can be used for. In essence, it returns what spaces can be accessed with the token and what Oneprovider services can be called to realize the data access. The response contains essential information about the spaces and supporting providers, which can be especially useful when implementing scripts and middleware performing data access on behalf of a user.

In the process, the token is first verified, but the following caveats are ignored: service, interface, api. This way, it is possible to learn the data access scope of a token that is limited to e.g. Oneclient access on a specific provider. That would not be possible using the other Onezone API endpoints, since they are disallowed due to the caveats.

Remaining caveats, such as time or ip, are still verified, hence only a client qualified to use the token can learn its data access scope.

Optionally, a consumer's identity token can be provided in the body to satisfy possible consumer caveats.

If the token cannot be positively verified, HTTP code 4xx is returned with an error describing the reason of failure.

If a provider access token is specified, the returned dataAccessScope is null.

This operation has public access.

Example cURL requests

Verify an access token

curl -X POST https://$ZONE_HOST/api/v3/onezone/tokens/infer_access_token_scope \
-H 'Content-type: application/json' \
-d '{"token": "MDAxNmxvY2F00aW9uIHZ2...", "consumerToken": "MDAx0aWNmH8g7SajXXZ8s..."}'

{
  "validUntil": 1700276800,
  "dataAccessScope": {
    "readonly": false,
    "spaces": {
      "f5a7f8b2336fae4bef8fe0fcc73a6e19ch1978": {
        "supports": {
          "6c215505a969202341a74c8f2c394318ch47a3": {
            "readonly": false,
            "storages": {
              "6920215505a94c8f2c394318ch47a3341a76c2": {
                "readonly": false,
              }
            }
          },
          "36e032c90969f520b84bf55bbc4d35c6chd39b": {
            "readonly": false,
            "storages": {
              "f2c36920215505a94c8h47a3341a76c294318c": {
                "readonly": false,
              },
              "2021558h47a3341a76c294318c05a9f2c3694c": {
                "readonly": true,
              }
            }
          }
        },
        "name": "Gamma"
      },
      "77849ee136244225207db1457cce8543ch8050": {
        "supports": {
          "36e032c90969f520b84bf55bbc4d35c6chd39b": {
            "readonly": true,
            "storages": {
              "4318cfh47a3341a76c292c36920215505a94c8": {
                "readonly": true,
              },
              "8h47a3320215541a7605a9f2c3694cc294318c": {
                "readonly": true,
              }
            }
          }
        },
        "name": "Delta"
      }
    },
    "providers": {
      "6c215505a969202341a74c8f2c394318ch47a3": {
        "version": "25.0",
        "online": true,
        "name": "Krakow",
        "domain": "krakow.onedata.example.com",
        "storages": [
          "6920215505a94c8f2c394318ch47a3341a76c2"
        ]
      },
      "36e032c90969f520b84bf55bbc4d35c6chd39b": {
        "version": "21.02.2",
        "online": false,
        "name": "Lisbon",
        "domain": "lisbon.onedata.example.com",
        "storages": [
          "f2c36920215505a94c8h47a3341a76c294318c",
          "2021558h47a3341a76c294318c05a9f2c3694c",
          "4318cfh47a3341a76c292c36920215505a94c8",
          "8h47a3320215541a7605a9f2c3694cc294318c"
        ]
      }
    }
  }
}