JSON Web Token (JWT) (original) (raw)

"client-nonce". A nonce previously provided to the AS by the RS via the client. Used to verify token freshness when the RS cannot synchronize its clock with the AS.

[IETF]

[RFC9200, Section 5.10]

exi

"Expires in". Lifetime of the token in seconds from the time the RS first sees it. Used to implement a weaker from of token expiration for devices that cannot synchronize their internal clocks.

[IETF]

[RFC9200, Section 5.10.3]

roles

Roles

[IETF]

[RFC7643, Section 4.1.2][RFC9068, Section 2.2.3.1]

groups

Groups

[IETF]

[RFC7643, Section 4.1.2][RFC9068, Section 2.2.3.1]

entitlements

Entitlements

[IETF]

[RFC7643, Section 4.1.2][RFC9068, Section 2.2.3.1]

token_introspection

Token introspection response

[IETF]

[RFC9701, Section 5]

eat_nonce

Nonce

[IETF]

[RFC9711]

ueid

Universal Entity ID

[IETF]

[RFC9711]

sueids

Semipermanent UEIDs

[IETF]

[RFC9711]

oemid

Hardware OEM ID

[IETF]

[RFC9711]

hwmodel

Model identifier for hardware

[IETF]

[RFC9711]

hwversion

Hardware Version Identifier

[IETF]

[RFC9711]

oemboot

Indicates whether the software booted was OEM authorized

[IETF]

[RFC9711]

dbgstat

The status of debug facilities

[IETF]

[RFC9711]

location

The geographic location

[IETF]

[RFC9711]

eat_profile

The EAT profile followed

[IETF]

[RFC9711]

submods

The section containing submodules

[IETF]

[RFC9711]

uptime

Uptime

[IETF]

[RFC9711]

bootcount

The number of times the entity or submodule has been booted

[IETF]

[RFC9711]

bootseed

Identifies a boot cycle

[IETF]

[RFC9711]

dloas

Certifications received as Digital Letters of Approval

[IETF]

[RFC9711]

swname

The name of the software running in the entity

[IETF]

[RFC9711]

swversion

The version of software running in the entity

[IETF]

[RFC9711]

manifests

Manifests describing the software installed on the entity

[IETF]

[RFC9711]

measurements

Measurements of the software, memory configuration, and such on the entity

[IETF]

[RFC9711]

measres

The results of comparing software measurements to reference values

[IETF]

[RFC9711]

intuse

The intended use of the EAT

[IETF]

[RFC9711]

cdniv

CDNI Claim Set Version

[IETF]

[RFC9246, Section 2.1.8]

cdnicrit

CDNI Critical Claims Set

[IETF]

[RFC9246, Section 2.1.9]

cdniip

CDNI IP Address

[IETF]

[RFC9246, Section 2.1.10]

cdniuc

CDNI URI Container

[IETF]

[RFC9246, Section 2.1.11]

cdniets

CDNI Expiration Time Setting for Signed Token Renewal

[IETF]

[RFC9246, Section 2.1.12]

cdnistt

CDNI Signed Token Transport Method for Signed Token Renewal

[IETF]

[RFC9246, Section 2.1.13]

cdnistd

CDNI Signed Token Depth

[IETF]

[RFC9246, Section 2.1.14]

sig_val_claims

Signature Validation Token

[IETF]

[RFC9321, Section 3.2.3]

authorization_details

The claim authorization_details contains a JSON array of JSON objects representing the rights of the access token. Each JSON object contains the data to specify the authorization requirements for a certain type of resource.

[IETF]

[RFC9396, Section 9.1]

verified_claims

A structured claim containing end-user claims and the details of how those end-user claims were assured.

[eKYC_and_Identity_Assurance_WG]

[OpenID Identity Assurance Schema Definition 1.0, Section 5]

place_of_birth

A structured claim representing the end-user's place of birth.

[eKYC_and_Identity_Assurance_WG]

[OpenID Connect for Identity Assurance Claims Registration 1.0, Section 4]

nationalities

String array representing the end-user's nationalities.

[eKYC_and_Identity_Assurance_WG]

[OpenID Connect for Identity Assurance Claims Registration 1.0, Section 4]

birth_family_name

Family name(s) someone has when they were born, or at least from the time they were a child. This term can be used by a person who changes the family name(s) later in life for any reason. Note that in some cultures, people can have multiple family names or no family name; all can be present, with the names being separated by space characters.

[eKYC_and_Identity_Assurance_WG]

[OpenID Connect for Identity Assurance Claims Registration 1.0, Section 4]

birth_given_name

Given name(s) someone has when they were born, or at least from the time they were a child. This term can be used by a person who changes the given name later in life for any reason. Note that in some cultures, people can have multiple given names; all can be present, with the names being separated by space characters.

[eKYC_and_Identity_Assurance_WG]

[OpenID Connect for Identity Assurance Claims Registration 1.0, Section 4]

birth_middle_name

Middle name(s) someone has when they were born, or at least from the time they were a child. This term can be used by a person who changes the middle name later in life for any reason. Note that in some cultures, people can have multiple middle names; all can be present, with the names being separated by space characters. Also note that in some cultures, middle names are not used.

[eKYC_and_Identity_Assurance_WG]

[OpenID Connect for Identity Assurance Claims Registration 1.0, Section 4]

salutation

End-user's salutation, e.g., "Mr"

[eKYC_and_Identity_Assurance_WG]

[OpenID Connect for Identity Assurance Claims Registration 1.0, Section 4]

title

End-user's title, e.g., "Dr"

[eKYC_and_Identity_Assurance_WG]

[OpenID Connect for Identity Assurance Claims Registration 1.0, Section 4]

msisdn

End-user's mobile phone number formatted according to ITU-T recommendation [E.164]

[eKYC_and_Identity_Assurance_WG]

[OpenID Connect for Identity Assurance Claims Registration 1.0, Section 4]

also_known_as

Stage name, religious name or any other type of alias/pseudonym with which a person is known in a specific context besides its legal name.

[eKYC_and_Identity_Assurance_WG]

[OpenID Connect for Identity Assurance Claims Registration 1.0, Section 4]

htm

The HTTP method of the request

[IETF]

[RFC9449, Section 4.2]

htu

The HTTP URI of the request (without query and fragment parts)

[IETF]

[RFC9449, Section 4.2]

ath

The base64url-encoded SHA-256 hash of the ASCII encoding of the associated access token's value

[IETF]

[RFC9449, Section 4.2]

atc

Authority Token Challenge

[IETF]

[RFC9447]

sub_id

Subject Identifier

[IETF]

[RFC9493, Section 4.1]

rcd

Rich Call Data Information

[IETF]

[RFC9795]

rcdi

Rich Call Data Integrity Information

[IETF]

[RFC9795]

crn

Call Reason

[IETF]

[RFC9795]

msgi

Message Integrity Information

[IETF]

[RFC9475]

_claim_names

JSON object whose member names are the Claim Names for the Aggregated and Distributed Claims

[OpenID_Foundation_Artifact_Binding_Working_Group]

[OpenID Connect Core 1.0, Section 5.6.2]

_claim_sources

JSON object whose member names are referenced by the member values of the _claim_names member

[OpenID_Foundation_Artifact_Binding_Working_Group]

[OpenID Connect Core 1.0, Section 5.6.2]

rdap_allowed_purposes

This claim describes the set of RDAP query purposes that are available to an identity that is presented for access to a protected RDAP resource.

[IETF]

[RFC9560, Section 3.1.5.1]

rdap_dnt_allowed

This claim contains a JSON boolean literal that describes a "do not track" request for server-side tracking, logging, or recording of an identity that is presented for access to a protected RDAP resource.

[IETF]

[RFC9560, Section 3.1.5.2]

geohash

Geohash String or Array

[Consumer_Technology_Association]

[Fast and Readable Geographical Hashing (CTA-5009)]

_sd

Digests of Disclosures for object properties

[IETF]

[RFC-ietf-oauth-selective-disclosure-jwt-22, Section 4.2.4.1]

...

Digest of the Disclosure for an array element