You're viewing **Apigee Edge** documentation.  
[Go to the
**Apigee X** documentation](http://cloud.google.com/apigee/docs/api-platform/reference/policies/set-oauth-v2-info-policy). info
![](https://docs.apigee.com/static/api-platform/images/icon_policy_security.jpg)

### What

Lets you add or update custom attributes associated with an access token. Custom attributes
might include things like department name, a customer ID, or a session identifier. See also
[Customizing Tokens and
Authorization Codes](https://docs.apigee.com/api-platform/security/oauth/customizing-access-tokens).

You can only add or modify custom attributes. You cannot use this policy to change fields like
scope, status, expires_in, developer_email, client_id, org_name, or refresh_count. If an
attribute already exists, this policy updates it. If it does not exist, the policy adds it. The
access token referenced must be valid and in an approved state.

## Samples

### Basic example

Below is an example policy used to update an OAuth 2.0 access token. The example below
locates the access token on the request message by looking for a query parameter called
`access_token`. When an access token is presented by a client app, the policy
below will locate the access token in the query parameter. It will then update the access
token's profile. It adds a custom property called `department.id` to the
profile.

```
<SetOAuthV2Info name="SetOAuthV2Info"> 
  <AccessToken ref="request.queryparam.access_token"></AccessToken>
  <Attributes>
    <Attribute name="department.id" ref="request.queryparam.department_id"></Attribute>
  </Attributes>
</SetOAuthV2Info>
```

> [!NOTE]
> **Note:** If an attribute already exists in the access token profile, then it will be updated with the new value in the policy. If an attribute does not exist, then the attribute will be added to the access token's profile.

*** ** * ** ***

## Element Reference

The element reference describes the elements and attributes of the SetOAuthV2 policy.

```
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<SetOAuthV2Info async="false" continueOnError="false" enabled="true" name="SetOAuthV2Info-1">    
    <DisplayName>Set OAuth v2.0 Info 1</DisplayName>
    <AccessToken ref={some-variable}></AccessToken>
    <Attributes/>
</SetOAuthV2Info>
</xml>
```

## \<SetOAuthV2Info\> attributes

```
<SetOAuthV2Info async="false" continueOnError="false" enabled="true" name="Set-OAuth-v20-Info-1">
```

The following table describes attributes that are common to all policy parent elements:

| Attribute | Description | Default | Presence |
|---|---|---|---|
| `name` | The internal name of the policy. The value of the `name` attribute can contain letters, numbers, spaces, hyphens, underscores, and periods. This value cannot exceed 255 characters. Optionally, use the `<DisplayName>` element to label the policy in the management UI proxy editor with a different, natural-language name. | N/A | Required |
| `continueOnError` | Set to `false` to return an error when a policy fails. This is expected behavior for most policies. Set to `true` to have flow execution continue even after a policy fails. | false | Optional |
| `enabled` | Set to `true` to enforce the policy. Set to `false` to *turn off* the policy. The policy will not be enforced even if it remains attached to a flow. | true | Optional |
| `async` | This attribute is deprecated. | false | Deprecated |

## \<DisplayName\> element

Use in addition to the `name` attribute to label the policy in the
management UI proxy editor with a different, natural-language name.

```
<DisplayName>Policy Display Name</DisplayName>
```

| Default | N/A If you omit this element, the value of the policy's `name` attribute is used. |
| Presence | Optional |
| Type | String |
|---|---|

## \<AccessToken\> element

Identifies the variable where the access token is located. For example, if the access token is
attached to request message as a query parameter, specify
`request.queryparam.access_token`. You can use any valid variable that references the
token. Or, could pass in the literal token string (rare case).

```
 <AccessToken ref="request.queryparam.access_token"></AccessToken>
```

|---|---|
| **Default:** | N/A |
| **Presence:** | Required |
| **Type:** | String |

### Attributes

| Attribute | Description | Default | Presence |
|---|---|---|---|
| ref | An access token variable. Typically, retrieved from a flow variable. | N/A | Optional |

## \<Attributes\> element

A set of attributes in the access token profile that will be modified or augmented.

|---|---|
| **Default:** | N/A |
| **Presence:** | Required |
| **Type:** | N/A |

## \<Attributes\>/\<Attribute\> element

An individual attribute to update.

The name attribute identifies the custom property of the access token profile to be
updated. This example shows how to use a referenced variable value and a static value.

```
  <Attributes>
    <Attribute name="department.id" ref="request.queryparam.department_id"></Attribute>
    <Attribute name="foo">bar</Attribute>
  </Attributes>
```

|---|---|
| **Default:** | N/A |
| **Presence:** | Optional |
| **Type:** | N/A |

### Attributes

| Attribute | Description | Default | Presence |
|---|---|---|---|
| name | The name of the profile attribute to add or change. | N/A |   |
| ref | The value to assign to the profile attribute. | N/A | Optional |

## Flow variables

On success, the following flow variables will be set:

- `oauthv2accesstoken.{policyName}.access_token`
- `oauthv2accesstoken.{policyName}.client_id`
- `oauthv2accesstoken.{policyName}.refresh_count`
- `oauthv2accesstoken.{policyName}.organization_name`
- `oauthv2accesstoken.{policyName}.expires_in //--in seconds`
- `oauthv2accesstoken.{policyName}.refresh_token_expires_in //--in seconds`
- `oauthv2accesstoken.{policyName}.issued_at`
- `oauthv2accesstoken.{policyName}.status`
- `oauthv2accesstoken.{policyName}.api_product_list`
- `oauthv2accesstoken.{policyName}.token_type`
- `oauthv2accesstoken.{policyName}.{custom_attribute_name}`

## Schema

Each policy type is defined by an XML schema (`.xsd`). For reference, [policy schemas](https://github.com/apigee/api-platform-samples/tree/master/schemas/policy)
are available on GitHub.

## Error reference


This section describes the fault codes and error messages that are returned and fault variables that are set by Edge when this policy triggers an error.
This information is important to know if you are developing fault rules to
handle faults. To learn more, see [What you need to know
about policy errors](https://docs.apigee.com/api-platform/fundamentals/what-you-need-know-about-policy-errors) and [Handling
faults](https://docs.apigee.com/api-platform/fundamentals/fault-handling).

### Runtime errors

These errors can occur when the policy executes.

> [!IMPORTANT]
> **Tip:** Use [API Monitoring](https://docs.apigee.com/api-monitoring) to investigate fault codes and diagnose issues faster. See [Set up a policy fault code alert](https://docs.apigee.com/api-monitoring/alerts-notifications#fault-code-alert) for an example. See [Fault code reference](https://docs.apigee.com/api-monitoring/fault-codes) for a complete list of all fault codes that you can handle with API Monitoring.

| Fault code | HTTP status | Cause |
|---|---|---|
| `steps.oauth.v2.access_token_expired` | 500 | The access token sent to the policy is expired. |
| `steps.oauth.v2.invalid_access_token` | 500 | The access token sent to the policy is invalid. |
| `steps.oauth.v2.InvalidAPICallAsNoApiProductMatchFound` | 401 | Please see [this Apigee Community post](https://discuss.google.dev/t/oauth2-0-access-token-verification-throws-invalid-api-call-as-no-apiproduct-match-found-error/17064) for information about troubleshooting this error. |

### Deployment errors

Refer to the message reported in the UI for information about deployment errors.

### Fault variables

These variables are set when this policy triggers an error at runtime.

> [!NOTE]
> **Note:** You an use these variables to create Fault Rule conditions. For more information, see [What you need to know
> about policy errors](https://docs.apigee.com/api-platform/fundamentals/what-you-need-know-about-policy-errors).

| Variables | Where | Example |
|---|---|---|
| `fault.name="fault_name"` | <var translate="no">fault_name</var> is the name of the fault, as listed in the [Runtime errors](https://docs.apigee.com/api-platform/reference/policies/set-oauth-v2-info-policy#runtime-errors) table above. The fault name is the last part of the fault code. | `fault.name = "invalid_access_token"` |
| `oauthV2.policy_name.failed` | <var translate="no">policy_name</var> is the user-specified name of the policy that threw the fault. | `oauthV2.SetTokenInfo.failed = true` |
| `oauthV2.policy_name.fault.name` | <var translate="no">policy_name</var> is the user-specified name of the policy that threw the fault. | `oauthV2.SetTokenInfo.fault.name = invalid_access_token` |
| `oauthv2.policy_name.fault.cause` | <var translate="no">policy_name</var> is the user-specified name of the policy that threw the fault. | `oauthV2.SetTokenInfo.cause = Invalid Access Token` |

### Example error response

```
{
  "fault": {
    "faultstring": "Invalid Access Token",
    "detail": {
      "errorcode": "keymanagement.service.invalid_access_token"
    }
  }
}
```

### Example fault rule

```
<FaultRule name=SetOAuthV2Info Faults">
    <Step>
        <Name>AM-InvalidTokenResponse</Name>
        <Condition>(fault.name = "invalid_access_token")</Condition>
    </Step>
    <Condition>(oauthV2.failed = true) </Condition>
</FaultRule>
```

<br />

## Related topics

- [OAuthV2 policy](https://docs.apigee.com/api-platform/reference/policies/oauthv2-policy)
- [OAuth home](https://docs.apigee.com/api-platform/security/oauth/oauth-home)
- [Customizing Tokens
  and Authorization Codes](https://docs.apigee.com/api-platform/security/oauth/customizing-access-tokens)