> For the complete documentation index, see [llms.txt](https://docs.corppass.gov.sg/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.corppass.gov.sg/technical-specifications/corppass-authorization-api-fapi-2.0/integration-guide/4.-userinfo-endpoint.md).

# 4. Userinfo Endpoint

The **Userinfo Endpoint** allows Relying Parties (RPs) to retrieve detailed information about the authenticated Entity and Acting User. These details are not included in the ID Token and must be fetched explicitly after authentication.

This is a Protected Resource, requiring a valid Access Token (obtained from the [Token Endpoint](/technical-specifications/corppass-authorization-api-fapi-2.0/integration-guide/3.-token-endpoint.md)) for access.

Currently, this endpoint primarily returns the user's Authorization Data (e.g., roles, authorized transactions), similar to the [Legacy Authorization Info Endpoint](/technical-specifications/corppass-authorization-api-legacy/endpoints/authorization-info-endpoint.md).

#### Supported TLS Cipher Suites

Please ensure you are using a supported cipher suite for this endpoint. Refer to [Supported TLS Cipher Suites](/technical-specifications/corppass-authorization-api-fapi-2.0/integration-guide/supported-tls-cipher-suites.md) for the full list.

## Request

To obtain additional entity or user information, send a `GET` request to the Userinfo Endpoint URL obtained from the [OpenID Discovery Endpoint](/technical-specifications/corppass-authorization-api-fapi-2.0/integration-guide/0.-well-known-endpoints/openid-discovery-endpoint.md) (`userinfo_endpoint`).

{% hint style="info" %}
Corppass supports both `GET` and `POST` methods for the Userinfo Endpoint.

The [OIDC Specification (Section 5.3.2)](https://openid.net/specs/openid-connect-core-1_0.html#UserInfo) **recommends using the `GET` method**.
{% endhint %}

#### Sample GET Request (Recommended)

```http
GET /userinfo HTTP/1.1
Authorization: DPoP eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...
DPoP: <signed-dpop-proof-jwt>
```

#### Sample POST Request

Request body is not required and will be ignored for `POST` request.&#x20;

```http
POST /userinfo HTTP/1.1
Content-Type: application/x-www-form-urlencoded; charset=utf-8
Authorization: DPoP eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...
DPoP: <signed-dpop-proof-jwt>
```

### Request Headers

<table><thead><tr><th width="171.21875">Header</th><th width="128.24609375">Required</th><th>Description</th></tr></thead><tbody><tr><td><code>Content-Type</code></td><td><code>POST</code> only</td><td><p>Indicates the encoding format of the request body.</p><p></p><p><strong>Validation:</strong></p><ul><li>Must be set to <code>application/x-www-form-urlencoded; charset=utf-8</code>. </li></ul></td></tr><tr><td><code>Authorization</code></td><td>Yes</td><td><p>Carries the Access Token issued at the <a href="/pages/tdw1eZJeFJxNFBu1QGx2">Token Endpoint</a>, using the <code>DPoP</code> scheme instead of the typical <code>Bearer</code> scheme.</p><p></p><p>Example:</p><p><code>Authorization: DPoP &#x3C;Access-Token></code> </p></td></tr><tr><td><code>DPoP</code></td><td>Yes</td><td><p>DPoP Proof JWT. A signed proof-of-possession JWT bound to the Access Token.</p><p></p><p><strong>Validation:</strong></p><ul><li>This proof must include the <code>ath</code> (Access Token Hash) claim. This ensures the proof is cryptographically linked to the specific Access Token used in the request, preventing token misuse.</li></ul><p></p><p>Refer to <a href="/pages/QOVgmxTpNTkdnLGQCrH6">Demonstrating Proof of Possession</a> section for more details.</p></td></tr></tbody></table>

## Success Response

The Userinfo Endpoint returns a response in the form of a **JSON Web Encryption (JWE) object**, encrypted using the client's public encryption key configured in their JWKS object / JWKS endpoint.

Inside the encrypted payload lies the **Signed JWT (JWS)**, signed using Corppass' private signing key. Refer to [ID Token](/technical-specifications/corppass-authorization-api-fapi-2.0/integration-guide/3.-token-endpoint/id-token.md) section for the decryption steps.

### Response Structure (Decoded Payload)

The following table details the claims found in the decoded JWS payload:

<table><thead><tr><th width="169.38671875">Claim</th><th width="113.74609375">Type</th><th width="460.13671875">Description</th></tr></thead><tbody><tr><td><code>aud</code></td><td>String</td><td>Audience. The client ID of the Relying Party for whom this token is intended.</td></tr><tr><td><code>iss</code></td><td>String</td><td>Issuer. The URL of the Corppass server that issued the token.</td></tr><tr><td><code>iat</code></td><td>Number</td><td>Issued At. The time the JWT was issued, expressed as a UNIX timestamp.</td></tr><tr><td><code>exp</code></td><td>Number</td><td><p>Expiration Time. The expiration time of the JWT.</p><p></p><p>Value is set to 10 minutes from <code>iat</code>.</p></td></tr><tr><td><code>sub</code></td><td>String</td><td>Subject. The unique identifier for the authenticated user (in this case, we return Client ID).</td></tr><tr><td><code>auth_info</code></td><td>JSON String</td><td><p>Authorization information assigned to the user.</p><p></p><p>Refer to <a href="/pages/giD7ZwzQnfKm4cE6N9q2">Auth Info</a> section for more details.<br></p><p><em>Required scope:</em> <code>authinfo</code></p></td></tr><tr><td><code>tp_auth_info</code></td><td>JSON String</td><td><p>Third-party authorization information assigned to the user.</p><p></p><p>Refer to <a href="/pages/IJSWuxVxMSVclsoKo9Wu">Third-party Auth Info</a> section for more details.<br></p><p><em>Required scope:</em> <code>tpauthinfo</code></p></td></tr><tr><td><code>entity_info</code></td><td>JSON String</td><td><p>Business-related information about the entity the user is transacting on behalf of.</p><p></p><p>Refer to <a href="/pages/Rq9I3YrjT7zPo96BfGQQ">Entity Info</a> section for more details.</p><p></p><p><em>Returned when</em></p><ul><li><a href="/pages/3alj7eVRTw8Ix32ItPzR">Myinfo Business entity scopes</a> are requested.</li><li>The digital service is a <a href="/pages/BjEY6I9zt1a9JXYueMqT">Myinfo Business application</a>.</li></ul></td></tr><tr><td><code>person_info</code></td><td>JSON String</td><td><p>Personal information about the user acting on behalf of the entity.</p><p></p><p>Refer to <a href="/pages/o5UBQVPVGZRsEmGdez09">Person Info</a> section for more details.<br></p><p><em>Returned when</em></p><ul><li><a href="/pages/K80z1ge7jIIJPTGAnUIR">Myinfo Business person scopes</a> are requested.</li><li>The digital service is a <a href="/pages/BjEY6I9zt1a9JXYueMqT">Myinfo Business application</a>.</li></ul></td></tr><tr><td><code>corppass_info</code></td><td>JSON String</td><td><p>Information about the transacting user’s Corppass account.</p><p></p><p>Refer to <a href="/pages/1URthCxHUdD16shwnz0o">Corppass Info</a> section for more details.<br></p><p><em>Returned when</em></p><ul><li><a href="/pages/h7CvMIhhrNwLkLqOifpK">Myinfo Business Corppass scopes</a> are requested.</li><li>The digital service is a <a href="/pages/BjEY6I9zt1a9JXYueMqT">Myinfo Business application</a>.</li></ul></td></tr></tbody></table>

### Sample Response (Decoded Payload)

{% code overflow="wrap" %}

```json
{
  "iat": 1624086842,
  "exp": 1624087442,
  "aud": "vOIljWVrGyBMK6f31QYq",
  "iss": "https://id.corppass.gov.sg",
  "sub": "vOIljWVrGyBMK6f31QYq",
  "auth_info": {
    ... // truncated for brevity, refer to Auth Info page for more details
  },
  "tp_auth_info": {
    ... // truncated for brevity, refer to Thrid-party Auth Info page for more details
  },
  "entity_info": {
    ... // truncated for brevity, refer to Entity Info page for more details
  },
  "person_info": {
    ... // truncated for brevity, refer to Person Info page for more details
  },
  "corppass_info": {
    ... // truncated for brevity, refer to Corppass Info page for more details
  }
}
```

{% endcode %}

## Error Response

If the Access Token is invalid, expired, or the DPoP proof fails, Corppass returns a JSON response containing an error code and description.

{% hint style="warning" %}
If the request lacks authentication altogether (e.g., no `Authorization` header or unsupported scheme), **Corppass will return HTTP 401 without including any error code, description, or body.**

This prevents revealing information about authentication requirements to unauthenticated or potentially malicious clients, as recommended by [RFC 6750 Section 3.1.](https://www.rfc-editor.org/rfc/rfc6750.html#section-3.1)
{% endhint %}

### Response Header

The response will always include the `WWW-Authenticate` header when the access token is missing or invalid. For DPoP-bound tokens, this header specifically indicates issues with the token or its associated proof.

```http
WWW-Authenticate: DPoP error="invalid_dpop_proof", error_description="DPoP proof iat is not recent enough"
```

### Response Body

<table><thead><tr><th width="214.66796875">Field</th><th width="136.328125">Type</th><th>Description</th></tr></thead><tbody><tr><td><code>error</code></td><td>String</td><td><p>A standardised error code identifying the type of error that occurred.</p><p><br>See <a href="#error-codes">Error Codes</a> below for a complete list of possible values.</p></td></tr><tr><td><code>error_description</code></td><td>String</td><td>A human-readable text description providing additional details about the error.</td></tr></tbody></table>

#### Error Codes

<table><thead><tr><th width="194.41796875">Error Code</th><th width="144.0234375">HTTP Status</th><th>Description</th></tr></thead><tbody><tr><td>invalid_request</td><td>400</td><td><p>This may be due to one of the following:</p><ul><li>A required request parameter is missing.</li><li>A request parameter is malformed or does not meet the expected format.</li><li>The client’s JWKS endpoint is not reachable.</li><li>The JWKS object is empty or the encryption key is not available.</li><li>The TLS cipher suite used for the connection is not compliant with <a href="https://openid.bitbucket.io/fapi/fapi-2_0-baseline.html#section-4.2">FAPI 2.0 security requirements</a>.</li></ul><p>Please ensure that:</p><ul><li>All required parameters are provided and correctly formatted.</li><li>Your JWKS endpoint is accessible and returns a valid key set that complies with the required <a href="/pages/4HeJT56VKL5MvRg3PAsJ">specification</a>.</li></ul></td></tr><tr><td>invalid_client</td><td>401</td><td><p>This may be due to one of the following:</p><ul><li>Missing client credential</li><li>Invalid client credential</li><li>Expired client credential</li><li>Improperly formatted client credential or assertion (e.g., malformed JWT)</li><li>The client’s JWKS does not contain the required signing key</li></ul><p>Please ensure that:</p><ul><li>The client credential is present, valid, and not expired</li><li>Your JWKS endpoint is accessible and returns a valid key set that complies with the required <a href="/pages/4HeJT56VKL5MvRg3PAsJ">specification</a>.</li></ul></td></tr><tr><td>invalid_token</td><td>401</td><td>Access token is expired, invalid, or not properly bound.</td></tr><tr><td>invalid_dpop_proof</td><td>401</td><td><p>This may due to the one of the following:</p><ul><li>The DPoP proof is expired.</li><li>The DPoP proof is malformed.</li><li>The DPoP proof failed signature verification.</li><li>The DPoP proof contains missing or invalid required claims.</li></ul><p>Please ensure that:</p><ul><li>The DPoP proof is correctly structured and signed using the client's private key.</li><li>The DPoP proof complies with the required <a href="/pages/QOVgmxTpNTkdnLGQCrH6">specification</a>.</li></ul></td></tr></tbody></table>

### Sample Response

<pre class="language-json"><code class="lang-json"><strong>{
</strong>  "error": "invalid_dpop_proof",
  "error_description": "DPoP proof iat is not recent enough"
}
</code></pre>