Merge pull request #358 from /issues/357-doc-validate-token

Fix #357: Improve documentation of Validate Token

docs/Readme.md

@@ -220,11 +220,13 @@ _Note: If a `--password` option is not provided, this method requires interactiv
 
 ### Validate Token
 
-Use a previously created token to authorize an operation.
+Token validation may be performed against any endpoint using [Token Based Authentication](https://github.com/wultra/powerauth-restful-integration/blob/develop/docs/RESTful-API-for-Spring.md#use-token-based-authentication).
+
+For example, use the previously created token to retrieve a list of operations.
 
 ```bash
 java -jar powerauth-java-cmd.jar \
-    --url "http://localhost:8080/enrollment-server/api/auth/token" \
+    --url "http://localhost:8080/enrollment-server/api/auth/token/app/operation/list" \
     --status-file "/tmp/pa_status.json" \
     --config-file "/tmp/pamk.json" \
     --method "validate-token" \
@@ -234,7 +236,9 @@ java -jar powerauth-java-cmd.jar \
     --token-secret "xfb1NUXAPbvDZK8qyNVGyw=="
 ```
 
-Uses the `validate-token` method for an activation with activation ID stored in the status file `/tmp/pa_status.json`, by calling an endpoint `/api/auth/token` hosted on root URL `http://localhost:8080/enrollment-server`. The endpoint must be published by the application -- see [Token Based Authentication](https://github.com/wultra/powerauth-restful-integration/blob/develop/docs/RESTful-API-for-Spring.md#use-token-based-authentication). Uses the application identifiers stored in the `/tmp/pamk.json` file. The request data is taken from file `/tmp/request.json`.
+Uses the `validate-token` method for an activation with activation ID stored in the status file `/tmp/pa_status.json`, by calling an endpoint `/api/auth/token/app/operation/list` hosted on root URL `http://localhost:8080/enrollment-server`.
+Uses the application identifiers stored in the `/tmp/pamk.json` file.
+The request data is taken from file `/tmp/request.json`.
 
 You can use the `dry-run` parameter, in this case the step is stopped right after signing the request body and preparing appropriate headers.