The request does not contain an access token. The service implementation should return "400 Bad Request" to the client application.

The access token does not cover the required scopes. To be concrete, the access token does not include the "openid" scope. The service implementation should return "403 Forbidden" to the client application.

The request from the service implementation was wrong or an error occurred in Authlete. The service implementation should return "500 Internal Server Error" to the client application.

The access token is valid. The service implementation should collect information about requested claims and pass the information to Authlete /auth/userinfo/issue endpoint in order to make Authlete generate an ID token.

The access token does not exist or has expired. The service implementation should return "401 Unauthorized" to the client application.