---
title: "Validate access token"
description: "Check whether an access token is still valid."
source: https://developers.qashio.com/v2/reference/get-oauth2-validate/
---

# Validate access token

`GET /oauth2/validate`

Requires a Bearer access token.

**Purpose.** Check whether an access token is still valid.

**Description.** Validates the Bearer token presented in the `Authorization` header and confirms
that the owning company's API access is enabled. Useful as a cheap liveness check before starting a
long sync, or to distinguish an expired token from a permissions problem after a `401`.

This endpoint does not use the standard response envelope.

**Input (header).** `Authorization: Bearer <access_token>`.

**Output.** `200` with `{ "active": true }`.

**Errors.**

| Status | Cause |
| --- | --- |
| `401` | Token missing, malformed, expired or revoked |
| `403` | Token is valid but API access is disabled for the company |

---

## Suggested integration flow

1. **Authenticate.** Complete the Qashio OAuth login, exchange the code at
   [`POST /oauth2/token`](#post-oauth2token), and store both tokens. Refresh before expiry with
   [Refresh access token](#post-oauth2tokenrefreshtoken).
2. **Load reference data once, then incrementally.** Pull suppliers, chart of accounts, tax rates and
   bank accounts, then re-pull with `updated_at_from` / `updated_at_to` on a schedule.
3. **Sync spend.** Poll [`GET /public/v1/erp/transactions`](#get-publicv1erptransactions) with
   `client_sync_status` set to `not_synced`, then `outdated`, post what comes back, and acknowledge
   the ids with [`POST /public/v1/erp/transactions/acknowledge`](#post-publicv1erptransactionsacknowledge)
   so the next poll skips them.
4. **Match refunds.** For any refund or reversal, follow `parent_qashio_id` back to the original
   purchase by filtering [`GET /public/v1/erp/transactions`](#get-publicv1erptransactions) on
   `qashio_id`, or list every child of a purchase by filtering on `parent_qashio_id`.
5. **Reconcile at period close.** Compare `opening_balance` / `closing_balance` from
   [`GET /public/v1/erp/statements`](#get-publicv1erpstatements) against your ledger, and
   [`GET /public/v1/erp/company/summary`](#get-publicv1erpcompanysummary) for the headline position.
6. **Manage cards.** Invite users, issue cards, set limits, and suspend a card when it is lost or
   stolen.

### Example request

```bash
curl -X GET 'https://api.qashio.com/oauth2/validate' \
  -H 'Accept: application/json' \
  -H 'Authorization: Bearer <access_token>'
```

### Example response (200)

```json
{
  "active": true
}
```

### Errors

- `401` Missing/invalid token