#### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt 'index')
### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt 'Abblix\.Jwt')

## JsonWebTokenTypes Class

The registry of `typ` header values that specifications fix: each is registered with IANA
\(or by the body that owns the profile\) and required verbatim by its counterparties, so none may
be changed\. The registry sits in the JWT core the way [JsonWebKeyTypes](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKeyTypes 'Abblix\.Jwt\.JsonWebKeyTypes') does for
`kty` values: every package building on the core shares one copy of the vocabulary instead
of drifting its own\.

```csharp
public static class JsonWebTokenTypes
```

Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → JsonWebTokenTypes

### Remarks
A product's own invented values do not belong here\. RFC 6838 Section 3\.2 gives them the vendor
tree \("vnd\." names for "media types associated with publicly available products"\), and they
live beside the product that mints them \- combined with this registry through the
[IsPermitted\(string, IReadOnlyList&lt;string&gt;, string\[\]\)](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebTokenTypes#Abblix.Jwt.JsonWebTokenTypes.IsPermitted(string,System.Collections.Generic.IReadOnlyList_string_,string[]) 'Abblix\.Jwt\.JsonWebTokenTypes\.IsPermitted\(string, System\.Collections\.Generic\.IReadOnlyList\<string\>, string\[\]\)')
overload, so refusal decisions still see both vocabularies\.
### Fields

## JsonWebTokenTypes\.AccessToken Field {#Abblix.Jwt.JsonWebTokenTypes.AccessToken}

The "AccessToken" JWT type is used to represent access tokens, typically used for authenticating
and authorizing users in APIs\.

```csharp
public const string AccessToken = "at+jwt";
```

#### Field Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

### Remarks
FIXED BY SPECIFICATION \- MUST NOT be changed\. Registered with IANA as `application/at+jwt` by
RFC 9068, which requires it verbatim: "JWT access tokens MUST include this media type in the typ header
parameter to explicitly declare that the JWT represents an access token complying with this profile"
\(Section 2\.1\)\. Every resource server that validates our access tokens rejects any other value, so a
change here is not a rename but a withdrawal from the profile\.

## JsonWebTokenTypes\.ClientAuthentication Field {#Abblix.Jwt.JsonWebTokenTypes.ClientAuthentication}

A JWT used to authenticate a client, per RFC 7523bis \(approved, awaiting its number\)\.

```csharp
public const string ClientAuthentication = "client-authentication+jwt";
```

#### Field Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

## JsonWebTokenTypes\.DPoPProof Field {#Abblix.Jwt.JsonWebTokenTypes.DPoPProof}

The "DPoP proof" JWT type per RFC 9449 §4\.2\. The `typ` header MUST equal this
value so a relying party that trusts the same client across multiple JWT types
\(id\_token, request\_object, DPoP proof\) cannot have one type replayed as another
per the RFC 8725 §3\.11 token\-type confusion guidance\.

```csharp
public const string DPoPProof = "dpop+jwt";
```

#### Field Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

## JsonWebTokenTypes\.EntityAttestation Field {#Abblix.Jwt.JsonWebTokenTypes.EntityAttestation}

An Entity Attestation Token, per RFC 9782\.

```csharp
public const string EntityAttestation = "eat+jwt";
```

#### Field Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

## JsonWebTokenTypes\.EntityStatement Field {#Abblix.Jwt.JsonWebTokenTypes.EntityStatement}

An OpenID Federation entity statement, registered by the OpenID Foundation\.

```csharp
public const string EntityStatement = "entity-statement+jwt";
```

#### Field Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

## JsonWebTokenTypes\.ExplicitRegistrationResponse Field {#Abblix.Jwt.JsonWebTokenTypes.ExplicitRegistrationResponse}

An OpenID Federation explicit registration response, registered by the OpenID Foundation\.

```csharp
public const string ExplicitRegistrationResponse = "explicit-registration-response+jwt";
```

#### Field Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

## JsonWebTokenTypes\.JwkSet Field {#Abblix.Jwt.JsonWebTokenTypes.JwkSet}

A signed JSON Web Key Set, registered by the OpenID Foundation\.

```csharp
public const string JwkSet = "jwk-set+jwt";
```

#### Field Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

## JsonWebTokenTypes\.Jwt Field {#Abblix.Jwt.JsonWebTokenTypes.Jwt}

Standard JSON Web Token type\.
Per RFC 7519 Section 5\.1, this is the recommended value for the 'typ' header parameter\.

```csharp
public const string Jwt = "JWT";
```

#### Field Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

## JsonWebTokenTypes\.KeyBinding Field {#Abblix.Jwt.JsonWebTokenTypes.KeyBinding}

An SD\-JWT key binding token, per RFC 9901\.

```csharp
public const string KeyBinding = "kb+jwt";
```

#### Field Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

## JsonWebTokenTypes\.Known Field {#Abblix.Jwt.JsonWebTokenTypes.Known}

Every `typ` named in this class except [Jwt](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebTokenTypes#Abblix.Jwt.JsonWebTokenTypes.Jwt 'Abblix\.Jwt\.JsonWebTokenTypes\.Jwt'), which says only that a thing is a JWT
and so cannot tell one kind from another\.

```csharp
public static readonly IReadOnlyList<string> Known;
```

#### Field Value
[System\.Collections\.Generic\.IReadOnlyList&lt;](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ireadonlylist-1 'System\.Collections\.Generic\.IReadOnlyList\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[&gt;](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ireadonlylist-1 'System\.Collections\.Generic\.IReadOnlyList\`1')

### Remarks
A value belongs here once this class names it, whoever issues it\. What decides whether a given one is
refused is not membership but the position it turns up in, and that is stated at each call site
rather than here \- see [IsPermitted\(string, string\[\]\)](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebTokenTypes#Abblix.Jwt.JsonWebTokenTypes.IsPermitted(string,string[]) 'Abblix\.Jwt\.JsonWebTokenTypes\.IsPermitted\(string, string\[\]\)')\.

Add a value when this class gains one. Leaving it out is the failure that matters: an omission is a
refusal that silently does not happen, and nothing anywhere reports it. Public rather than private,
because a product combines this list with its own vendor values and hands the union back through the
list-taking [IsPermitted\(string, IReadOnlyList&lt;string&gt;, string\[\]\)](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebTokenTypes#Abblix.Jwt.JsonWebTokenTypes.IsPermitted(string,System.Collections.Generic.IReadOnlyList_string_,string[]) 'Abblix\.Jwt\.JsonWebTokenTypes\.IsPermitted\(string, System\.Collections\.Generic\.IReadOnlyList\<string\>, string\[\]\)')
overload.

## JsonWebTokenTypes\.LogoutToken Field {#Abblix.Jwt.JsonWebTokenTypes.LogoutToken}

The "LogoutToken" JWT type is used in the context of OpenID Connect for single logout functionality\.

```csharp
public const string LogoutToken = "logout+jwt";
```

#### Field Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

### Remarks
FIXED BY SPECIFICATION \- MUST NOT be changed\. Registered with IANA as `application/logout+jwt` by
the OpenID Foundation and required by OpenID Connect Back\-Channel Logout, which the relying parties we
notify implement\. A different value would leave every one of them unable to recognise the token\.

## JsonWebTokenTypes\.ProvidedClaims Field {#Abblix.Jwt.JsonWebTokenTypes.ProvidedClaims}

Claims provided to an identity assurance verifier, registered by the OpenID Foundation\.

```csharp
public const string ProvidedClaims = "provided-claims+jwt";
```

#### Field Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

## JsonWebTokenTypes\.RequestObject Field {#Abblix.Jwt.JsonWebTokenTypes.RequestObject}

An OAuth 2\.0 request object, per RFC 9101\.

```csharp
public const string RequestObject = "oauth-authz-req+jwt";
```

#### Field Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

## JsonWebTokenTypes\.ResolveResponse Field {#Abblix.Jwt.JsonWebTokenTypes.ResolveResponse}

An OpenID Federation resolve response, registered by the OpenID Foundation\.

```csharp
public const string ResolveResponse = "resolve-response+jwt";
```

#### Field Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

## JsonWebTokenTypes\.SecurityEvent Field {#Abblix.Jwt.JsonWebTokenTypes.SecurityEvent}

A Security Event Token, per RFC 8417\.

```csharp
public const string SecurityEvent = "secevent+jwt";
```

#### Field Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

## JsonWebTokenTypes\.StatusList Field {#Abblix.Jwt.JsonWebTokenTypes.StatusList}

A token status list, per the OAuth status list specification \(approved, awaiting its number\)\.

```csharp
public const string StatusList = "statuslist+jwt";
```

#### Field Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

## JsonWebTokenTypes\.TokenIntrospection Field {#Abblix.Jwt.JsonWebTokenTypes.TokenIntrospection}

The "token introspection response" JWT type per RFC 9701 §5\. The `typ` header equals this value so a
signed introspection response cannot be replayed as a different JWT type \(RFC 8725 §3\.11\)\.

```csharp
public const string TokenIntrospection = "token-introspection+jwt";
```

#### Field Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

## JsonWebTokenTypes\.TrustMark Field {#Abblix.Jwt.JsonWebTokenTypes.TrustMark}

An OpenID Federation trust mark, registered by the OpenID Foundation\.

```csharp
public const string TrustMark = "trust-mark+jwt";
```

#### Field Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

## JsonWebTokenTypes\.TrustMarkDelegation Field {#Abblix.Jwt.JsonWebTokenTypes.TrustMarkDelegation}

An OpenID Federation trust mark delegation, registered by the OpenID Foundation\.

```csharp
public const string TrustMarkDelegation = "trust-mark-delegation+jwt";
```

#### Field Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

## JsonWebTokenTypes\.TrustMarkStatusResponse Field {#Abblix.Jwt.JsonWebTokenTypes.TrustMarkStatusResponse}

An OpenID Federation trust mark status response, registered by the OpenID Foundation\.

```csharp
public const string TrustMarkStatusResponse = "trust-mark-status-response+jwt";
```

#### Field Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

## JsonWebTokenTypes\.VerifiableCredential Field {#Abblix.Jwt.JsonWebTokenTypes.VerifiableCredential}

A W3C Verifiable Credential secured as a JWT\.

```csharp
public const string VerifiableCredential = "vc+jwt";
```

#### Field Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

## JsonWebTokenTypes\.VerifiablePresentation Field {#Abblix.Jwt.JsonWebTokenTypes.VerifiablePresentation}

A W3C Verifiable Presentation secured as a JWT\.

```csharp
public const string VerifiablePresentation = "vp+jwt";
```

#### Field Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')
### Methods

## JsonWebTokenTypes\.IsPermitted\(string, string\[\]\) Method {#Abblix.Jwt.JsonWebTokenTypes.IsPermitted(string,string[])}

Reports whether a `typ` is one this position permits, so that a JWT meant for a different purpose
can be refused where it has no business being\.

```csharp
public static bool IsPermitted(string? tokenType, params string[] permittedTypes);
```
#### Parameters

###### `tokenType` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Jwt.JsonWebTokenTypes.IsPermitted(string,string[]).tokenType}

The `typ` header parameter of the incoming JWT, which may be absent\.

###### `permittedTypes` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') {#Abblix.Jwt.JsonWebTokenTypes.IsPermitted(string,string[]).permittedTypes}

The types this position permits\. Pass none where the JWT that belongs there carries no `typ` at
all, as an ID token does \- then every type this class names is out of place\.

#### Returns
[System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean')  
`true` for an absent, generic or unfamiliar value and for any of [permittedTypes](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebTokenTypes#Abblix.Jwt.JsonWebTokenTypes.IsPermitted(string,string[]).permittedTypes 'Abblix\.Jwt\.JsonWebTokenTypes\.IsPermitted\(string, string\[\]\)\.permittedTypes');
            `false` only for a type this class names that is not among them\.

### Remarks
This enumerates what to refuse rather than what to accept, which is the opposite of the usual
preference, and the reason is that the accepting side cannot be enumerated\. RFC 7523bis allows a client
authentication JWT to be typed "client\-authentication\+jwt or another more specific explicit type value
defined by a specification profiling this specification", and RFC 9101 Section 4 observes of the request
object that "some existing deployments may alternatively be using the type application/jwt"\. An allow
list would refuse conformant senders on both counts, so an absent, generic or unfamiliar value passes
untouched and a sender that never heard of explicit typing is unaffected\.

What is refused therefore depends on where the question is asked, which is why what belongs is
named by the caller. The alternative - one list of everything a server issues - was too narrow at
half the call sites: a client assertion and a request object are verified with the CLIENT's key, so the
client chooses the `typ` and can present a JWT it signed for some entirely different purpose.
Refusing by kind is the mutually exclusive validation RFC 8725 Section 3.12 asks for.

## JsonWebTokenTypes\.IsPermitted\(string, IReadOnlyList\<string\>, string\[\]\) Method {#Abblix.Jwt.JsonWebTokenTypes.IsPermitted(string,System.Collections.Generic.IReadOnlyList_string_,string[])}

The same refusal\-by\-kind decision over a caller\-supplied vocabulary: a product whose known
set is this registry PLUS its own vendor values passes the union here, so its refusals see
both\.

```csharp
public static bool IsPermitted(string? tokenType, System.Collections.Generic.IReadOnlyList<string> knownTypes, params string[] permittedTypes);
```
#### Parameters

###### `tokenType` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Jwt.JsonWebTokenTypes.IsPermitted(string,System.Collections.Generic.IReadOnlyList_string_,string[]).tokenType}

The `typ` header parameter of the incoming JWT, which may be absent\.

###### `knownTypes` [System\.Collections\.Generic\.IReadOnlyList&lt;](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ireadonlylist-1 'System\.Collections\.Generic\.IReadOnlyList\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[&gt;](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ireadonlylist-1 'System\.Collections\.Generic\.IReadOnlyList\`1') {#Abblix.Jwt.JsonWebTokenTypes.IsPermitted(string,System.Collections.Generic.IReadOnlyList_string_,string[]).knownTypes}

Every type the caller can name, this registry's and its own alike\.

###### `permittedTypes` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') {#Abblix.Jwt.JsonWebTokenTypes.IsPermitted(string,System.Collections.Generic.IReadOnlyList_string_,string[]).permittedTypes}

The types this position permits\.

#### Returns
[System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean')  
`true` for an absent, generic or unfamiliar value and for any of [permittedTypes](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebTokenTypes#Abblix.Jwt.JsonWebTokenTypes.IsPermitted(string,System.Collections.Generic.IReadOnlyList_string_,string[]).permittedTypes 'Abblix\.Jwt\.JsonWebTokenTypes\.IsPermitted\(string, System\.Collections\.Generic\.IReadOnlyList\<string\>, string\[\]\)\.permittedTypes');
            `false` only for a known type that is not among them\.