src/main/java/com/authlete/jaxrs/BaseResourceEndpoint.java
public AccessTokenInfo validateAccessToken(
            AuthleteApi api, String accessToken, String[] requiredScopes, String requiredSubject, String clientCertificate) throws WebApplicationException
    {
        try
        {
            // Validate the access token and obtain the information about it.
            return new AccessTokenValidator(api)
                    .validate(accessToken, requiredScopes, requiredSubject, clientCertificate);
        }
        catch (WebApplicationException e)
        {
            // The access token is invalid. (Or an network error, or some others.)
            onError(e);

            throw e;
        }
    }
public AccessTokenInfo validateAccessToken(
            AuthleteApi api, String accessToken, String[] requiredScopes, String requiredSubject, String clientCertificate) throws WebApplicationException
    {
        try
        {
            // Validate the access token and obtain the information about it.
            return new AccessTokenValidator(api)
                    .validate(accessToken, requiredScopes, requiredSubject, clientCertificate);
        }
        catch (WebApplicationException e)
        {
            // The access token is invalid. (Or an network error, or some others.)
            onError(e);

            throw e;
        }
    }
Validate an access token.

<p>
This method internally creates a {@link AccessTokenValidator} instance and
calls its {@link AccessTokenValidator#validate(String, String[], String, String)
validate()} method. Then, this method uses the value returned from the
{@code validate()} method as a response from this method.
</p>

<p>
When {@code AccessTokenValidator.validate()} method raises a {@link
WebApplicationException}, this method calls {@link #onError(WebApplicationException)
onError()} method with the exception. The default implementation of {@code onError()}
calls {@code printStackTrace()} of the exception and does nothing else. You
can override the method as necessary. After calling {@code onError()} method,
this method re-throws the exception. The response contained in the exception
complies with the requirements described in <a href=
"http://tools.ietf.org/html/rfc6750">RFC 6750</a> (The OAuth 2.0 Authorization
Framework: Bearer Token Usage).
</p>

@param api
Implementation of {@link AuthleteApi} interface.

@param accessToken
An access token to validate.

@param requiredScopes
Scopes that must be associated with the access token.
{@code null} is okay.

@param requiredSubject
Subject (= user's unique identifier) that must be associated
with the access token. {@code null} is okay.

@param clientCertificate
TLS Certificate of the client presented during a call to
the resource server, used with TLS-bound access tokens.
Can be {@code null} if no certificate is presented.

@return
Information about the access token.

@throws WebApplicationException
The access token is invalid. To be concrete, one or more of
the following conditions meet.
<ol>
<li>The access token does not exist.
<li>The access token has expired.
<li>The access token does not cover the required scopes.
<li>The access token is not associated with the required subject.
</ol>