Mule OAuth2 Sample Client Resource Protection

gistfile1.xml

<flow name="validateAccessTokenForAuthorizedClientOnly">
    <http:inbound-endpoint address="http://localhost:8080/api/oauth2/validate_access_token" />
    <oauth2-provider:validate-client />
    <oauth2-provider:validate />
    <set-variable variableName="token_expires_in_seconds" value="#[flowVars['mule.oauth2.access_token_store_holder'].accessToken.expiresIn.toDuration().standardSeconds]" />
    <set-payload value="#[atsh=flowVars['mule.oauth2.access_token_store_holder'];['scopes':atsh.authorizationRequest.?scopes,'roles':atsh.resourceOwnerRoles,'username':atsh.resourceOwnerAuthentication.?principal.username,'token_expires_in_seconds':flowVars['token_expires_in_seconds']]]" />
    <json:object-to-json-transformer />
    <http:response-builder status="200" contentType="application/json">
        <http:cache-control directive="private"
                            noCache="false"
                            noStore="false"
                            mustRevalidate="false"
                            maxAge="#[flowVars['token_expires_in_seconds']]"
                            />
    </http:response-builder>
</flow>