RFC 7662 Token Introspection: querying the status live
Token introspection lets a resource server ask the authorisation server whether a token is still active and what it allows. For mandates it is the mechanism that enforces a revocation immediately.
The principle
The resource server sends the token to the introspection endpoint and receives active true or false with details. It does not have to evaluate the token's content itself.
At Mandact
The introspection endpoint of the earlier OAuth bridge is withdrawn (410 Gone). The same principle — query the status live instead of trusting a token until expiry — Mandact implements via /v1/verify: a revoked mandate is invalid from the next check.
Trade-off
Introspection costs one call per check. For actions with legal effect that is the right price: better one more check than a revoked mandate that is still accepted.
Status
Explains the standard; the earlier Mandact endpoint is withdrawn (410 Gone).