> ## Documentation Index
> Fetch the complete documentation index at: https://developers.authlete.com/llms.txt
> Use this file to discover all available pages before exploring further.

# responseContent of a Valid Introspection Response

> Why Authlete returns Bearer error="invalid_request" as responseContent even when the introspected access token is valid.

When a valid access token is sent to Authlete's [/auth/introspection](/api-reference/introspection-endpoint/process-introspection-request)
API, the response says the token is valid — and still carries
`Bearer error="invalid_request"` as `responseContent`.

```json highlight={4,10} theme={null}
{
  "resultCode": "A056001",
  "resultMessage": "[A056001] The access token is valid.",
  "action": "OK",
  "clientId": 1048476397,
  "subject": "user123",
  "existent": true,
  "usable": true,
  "refreshable": true,
  "responseContent": "Bearer error=\"invalid_request\"",
  "expiresAt": 1789564514000
}
```

This is not a sign that anything went wrong. `action: OK` is the field that
reports the outcome of the introspection: the access token exists and has not
expired, and the resource server should serve the protected resource.

`responseContent` is not a result — it is a prepared value for the
`WWW-Authenticate` header, for the case where the resource server decides to
reject the request anyway. `Bearer error="invalid_request"` is the simplest
string usable with `400 Bad Request`, and it is what Authlete returns when
`action` is `OK`, because at that point the token is fine and the only thing
left to complain about is the request itself.

```http theme={null}
HTTP/1.1 400 Bad Request
WWW-Authenticate: Bearer error="invalid_request"
Cache-Control: no-store
Pragma: no-cache
```

In practice, tell the client what is actually wrong rather than sending this
bare string — the developer of the client application cannot act on
`invalid_request` alone.

Note also that `responseContent` is formatted for the `Bearer` token type
([RFC 6750](https://www.rfc-editor.org/rfc/rfc6750)). A service that uses a
different token type has to build the error response itself.

See also:

* [JavaDoc for Class IntrospectionResponse](https://authlete.github.io/authlete-java-common/com/authlete/common/dto/IntrospectionResponse.html)