src/main/java/com/authlete/jaxrs/AccessTokenValidator.java
public AccessTokenInfo validate(
            String accessToken, String[] requiredScopes, String requiredSubject, String clientCertificate) throws WebApplicationException
    {
        if (accessToken == null)
        {
            // Return "400 Bad Request".
            throw toException(Status.BAD_REQUEST, CHALLENGE_ON_MISSING_ACCESS_TOKEN);
        }

        try
        {
            return process(accessToken, requiredScopes, requiredSubject, clientCertificate);
        }
        catch (WebApplicationException e)
        {
            throw e;
        }
        catch (Throwable t)
        {
            // Unexpected error.
            throw unexpected("Unexpected error in AccessTokenValidator", t);
        }
    }
public AccessTokenInfo validate(
            String accessToken, String[] requiredScopes, String requiredSubject, String clientCertificate) throws WebApplicationException
    {
        if (accessToken == null)
        {
            // Return "400 Bad Request".
            throw toException(Status.BAD_REQUEST, CHALLENGE_ON_MISSING_ACCESS_TOKEN);
        }

        try
        {
            return process(accessToken, requiredScopes, requiredSubject, clientCertificate);
        }
        catch (WebApplicationException e)
        {
            throw e;
        }
        catch (Throwable t)
        {
            // Unexpected error.
            throw unexpected("Unexpected error in AccessTokenValidator", t);
        }
    }
Validate an access token.

</p>
When the given access token is not valid, this method throws a
{@link WebApplicationException}. The response contained in the
exception complies with the requirements described in <a href=
"http://tools.ietf.org/html/rfc6750">RFC 6750</a> (The OAuth
2.0 Authorization Framework: Bearer Token Usage).
</p>

@param accessToken
An access token to validate.

@param requiredScopes
Scopes that must be associated with the access token.
{@code null} is okay.

@param requiredSubject
Subject (= user's unique identifier) that must be associated
with the access token. {@code null} is okay.

@param clientCertificate
TLS Certificate of the client presented during a call to
the resource server, used with TLS-bound access tokens.
Can be {@code null} if no certificate is presented.

@return
Information about the access token.

@throws WebApplicationException
The access token is invalid. To be concrete, one or more of
the following conditions meet.
<ol>
<li>The access token does not exist.
<li>The access token has expired.
<li>The access token does not cover the required scopes.
<li>The access token is not associated with the required subject.
</ol>