openid-data-classes/at.asitplus.openid/TokenIntrospectionJwtPayload

TokenIntrospectionJwtPayload

@Serializable

data class TokenIntrospectionJwtPayload(val issuer: String, val audience: Set<String>, val issuedAt: Instant, val tokenIntrospection: TokenIntrospectionResponse)(source)

RFC 9701 5.: Claims of the TokenIntrospectionJwtResponse. Leaves out sub and exp, as the JWT SHOULD NOT include them, so that it can not be misused as an access token.

Constructors

constructor(issuer: String, audience: Set<String>, issuedAt: Instant, tokenIntrospection: TokenIntrospectionResponse)

Properties

audience

@SerialName(value = "aud")

@Serializable(with = JwtAudienceSerializer::class)

val audience: Set<String>

REQUIRED. Identifies the resource server receiving the token introspection response; a single string on the wire for one audience, else an array (RFC 7519 4.1.3).

issuedAt

@SerialName(value = "iat")

@Serializable(with = InstantLongSerializer::class)

val issuedAt: Instant

REQUIRED. The time when the authorization server created the introspection response.

issuer

@SerialName(value = "iss")

val issuer: String

REQUIRED. The issuer identifier of the authorization server.

tokenIntrospection

@SerialName(value = "token_introspection")

val tokenIntrospection: TokenIntrospectionResponse

REQUIRED. The members of the token introspection response (RFC 7662 2.2). For an invalid, expired, revoked token, or a token not intended for the calling resource server, only active with false.