GET /oauth/userinfo

OpenID Connect UserInfo endpoint. Uses Bearer Token authentication, returns flat UserInfo JSON (no code/message envelope). When scope includes "profile", queries user profile from profile-service and merges into response. When verification-service is configured, additionally queries age group/minor status. See OpenID Connect Core 1.0 §5.3 (UserInfo Endpoint).

Request Parameters

Name	In	Type	Required	Default	Example	Constraints	Description
Authorization	header	string	Yes				Bearer <access_token>

Responses

Status	Description	Schema
200	UserInfo response (contains OIDC standard claims such as sub, name, email, picture)	dto.OIDCUserInfoResponse
401	invalid_token: Token is invalid or expired. See OIDC Core §5.3.	dto.OAuthErrorResponse

Referenced Schemas

dto.OAuthErrorResponse

OAuth standard error response

Field	Type	Required	Example	Constraints	Description
error	string	No	invalid_request		Error code
error_description	string	No	Missing required parameter		Error description
error_uri	string	No	https://docs.example.com/errors		Error URI
state	string	No	state-123		Status

dto.OIDCUserInfoResponse

Field	Type	Required	Example	Constraints	Description
age_group	string	No
birthdate	string	No	1990-01-15
client_id	string	No	app-123		Internal
family_name	string	No	Doe
gender	string	No	male
given_name	string	No	John
is_minor	boolean	No			Verification (age/minor status)
locale	string	No	en-US
name	string	No	John Doe		OIDC Standard Claims (optional, filled when scope=profile)
nickname	string	No	Johnny
picture	string	No	https://cdn.example.com/avatars/usr_abc123.jpg
preferred_username	string	No	john
scope	string	No	openid profile
sub	string	No	usr_abc123		User ID (required)
updated_at	integer	No	1743728400
website	string	No	https://johndoe.com
zoneinfo	string	No	America/Los_Angeles