feat: more rop claims

docs/oauth2-oidc/resource-owner-password-grant.mdx

@@ -48,3 +48,43 @@
     Client->>User: Use access token
 `} />
 ```
+
+## Token introspection and acces token claims
+
+The access token that is issued can be introspected using the OAuth 2.0 Token Introspection endpoint. The following claims
+returned from the introspection endpoint, and part of the access token if the config paramter `strategies.access_token` is set to
+`jwt`:
+
+- `sub`: The Ory Network identity ID of the user.
+- `client_id`: The ID of the OAuth 2.0 client.
+- `scope`: The scope of the token, as configured by the client and requested in the token request.
+- `aud`: The audience of the token, as configured by the client.
+- `iss`: The issuer of the token, the URL of the Ory Network instance.
+- `ext.username`: The username of the user, as passed in the token request.
+
+An example of the body returned from the introspection endpoint:
+
+```json
+{
+  "active": true,
+  "scope": "offline",
+  "client_id": "70d417fc-2aea-4830-b247-f140a9c4bae1",
+  "sub": "70d417fc-2aea-4901-4830-f140a9c412f7",
+  "exp": 1730210703,
+  "iat": 1730207103,
+  "nbf": 1730207103,
+  "username": "ory-username",
+  "aud": ["https://aud.example.com"],
+  "iss": "https://issuer.example.com",
+  "token_type": "Bearer",
+  "token_use": "access_token",
+  "ext": {
+    "username": "ory-username"
+  }
+}
+```
+
+### Customizing the claims
+
+The claims in the access token and introspection data can be further customized using a
+[token hook](/hydra/guides/oauth2-webhooks.mdx).