#### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index')
### [Abblix\.Oidc\.Server\.Common](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common 'Abblix\.Oidc\.Server\.Common')

## AuthorizationContext Class

Represents the context of an authorization process, encapsulating the key parameters required for processing
authorization requests\.

```csharp
public record AuthorizationContext : System.IEquatable<Abblix.Oidc.Server.Common.AuthorizationContext>
```

Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → AuthorizationContext

Implements [System\.IEquatable&lt;](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')[AuthorizationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.AuthorizationContext 'Abblix\.Oidc\.Server\.Common\.AuthorizationContext')[&gt;](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')

### Remarks
This record is pivotal for tracking the state of an authorization request throughout its lifecycle\.
It encapsulates details that are critical for the secure issuance of authorization codes and tokens,
while ensuring compliance with OAuth 2\.0 and OpenID Connect protocols\. The context facilitates
not just the validation of requests at the token endpoint, but also supports secure interactions
by incorporating mechanisms like PKCE and nonce values to mitigate common attack vectors such as
code injection and replay attacks\. Furthermore, it carries information about requested scopes and claims,
enabling fine\-grained access control and personalized identity assertion in accordance with the client's needs
and the authorization server's policies\.
### Constructors

## AuthorizationContext\(string, ScopeDefinition\[\], ResourceDefinition\[\], RequestedClaims\) Constructor {#Abblix.Oidc.Server.Common.AuthorizationContext.AuthorizationContext(string,Abblix.Oidc.Server.Common.Constants.ScopeDefinition[],Abblix.Oidc.Server.Common.Constants.ResourceDefinition[],Abblix.Oidc.Server.Model.RequestedClaims)}

Initializes a new instance of the [AuthorizationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.AuthorizationContext 'Abblix\.Oidc\.Server\.Common\.AuthorizationContext') class with a client ID,
a collection of scopes, and optional requested claims\.

```csharp
public AuthorizationContext(string clientId, Abblix.Oidc.Server.Common.Constants.ScopeDefinition[] scopes, Abblix.Oidc.Server.Common.Constants.ResourceDefinition[] resources, Abblix.Oidc.Server.Model.RequestedClaims? requestedClaims);
```
#### Parameters

###### `clientId` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Common.AuthorizationContext.AuthorizationContext(string,Abblix.Oidc.Server.Common.Constants.ScopeDefinition[],Abblix.Oidc.Server.Common.Constants.ResourceDefinition[],Abblix.Oidc.Server.Model.RequestedClaims).clientId}

The unique identifier of the client making the authorization request\.

###### `scopes` [ScopeDefinition](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ScopeDefinition 'Abblix\.Oidc\.Server\.Common\.Constants\.ScopeDefinition')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') {#Abblix.Oidc.Server.Common.AuthorizationContext.AuthorizationContext(string,Abblix.Oidc.Server.Common.Constants.ScopeDefinition[],Abblix.Oidc.Server.Common.Constants.ResourceDefinition[],Abblix.Oidc.Server.Model.RequestedClaims).scopes}

An array of scope definitions requested by the client\.

###### `resources` [ResourceDefinition](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ResourceDefinition 'Abblix\.Oidc\.Server\.Common\.Constants\.ResourceDefinition')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') {#Abblix.Oidc.Server.Common.AuthorizationContext.AuthorizationContext(string,Abblix.Oidc.Server.Common.Constants.ScopeDefinition[],Abblix.Oidc.Server.Common.Constants.ResourceDefinition[],Abblix.Oidc.Server.Model.RequestedClaims).resources}

An array of resource definitions associated with the authorization request\.

###### `requestedClaims` [RequestedClaims](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.RequestedClaims 'Abblix\.Oidc\.Server\.Model\.RequestedClaims') {#Abblix.Oidc.Server.Common.AuthorizationContext.AuthorizationContext(string,Abblix.Oidc.Server.Common.Constants.ScopeDefinition[],Abblix.Oidc.Server.Common.Constants.ResourceDefinition[],Abblix.Oidc.Server.Model.RequestedClaims).requestedClaims}

Optional claims requested by the client for the authorization process\.

## AuthorizationContext\(string, string\[\], RequestedClaims, Uri\[\]\) Constructor {#Abblix.Oidc.Server.Common.AuthorizationContext.AuthorizationContext(string,string[],Abblix.Oidc.Server.Model.RequestedClaims,System.Uri[])}

Initializes a new instance of the [AuthorizationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.AuthorizationContext 'Abblix\.Oidc\.Server\.Common\.AuthorizationContext') class\.

```csharp
public AuthorizationContext(string clientId, string[] scope, Abblix.Oidc.Server.Model.RequestedClaims? requestedClaims, System.Uri[]? resources=null);
```
#### Parameters

###### `clientId` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Common.AuthorizationContext.AuthorizationContext(string,string[],Abblix.Oidc.Server.Model.RequestedClaims,System.Uri[]).clientId}

The unique identifier of the client making the authorization request\.

###### `scope` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') {#Abblix.Oidc.Server.Common.AuthorizationContext.AuthorizationContext(string,string[],Abblix.Oidc.Server.Model.RequestedClaims,System.Uri[]).scope}

An array of scope values requested by the client, representing the access permissions being sought\.

###### `requestedClaims` [RequestedClaims](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.RequestedClaims 'Abblix\.Oidc\.Server\.Model\.RequestedClaims') {#Abblix.Oidc.Server.Common.AuthorizationContext.AuthorizationContext(string,string[],Abblix.Oidc.Server.Model.RequestedClaims,System.Uri[]).requestedClaims}

Optional claims that the client is requesting as part of the authorization process,
providing additional information about the user's identity\.

###### `resources` [System\.Uri](https://learn.microsoft.com/en-us/dotnet/api/system.uri 'System\.Uri')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') {#Abblix.Oidc.Server.Common.AuthorizationContext.AuthorizationContext(string,string[],Abblix.Oidc.Server.Model.RequestedClaims,System.Uri[]).resources}

Optional RFC 8707 resource indicators \(absolute URIs\) the issued token is bound to\. This is
the single construction point every path funnels the resource set through: the direct grants
\(client\_credentials, password, jwt\-bearer, token\-exchange\), the authorize/CIBA/device path
\(via the [ScopeDefinition](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ScopeDefinition 'Abblix\.Oidc\.Server\.Common\.Constants\.ScopeDefinition')/[ResourceDefinition](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ResourceDefinition 'Abblix\.Oidc\.Server\.Common\.Constants\.ResourceDefinition') overload below\), and
the JWT round\-trip\. An empty set is canonicalized to `null` \(no audience restriction\)\.
### Properties

## AuthorizationContext\.Actor Property {#Abblix.Oidc.Server.Common.AuthorizationContext.Actor}

RFC 8693 §4\.1 `act` claim: the actor party \(in delegation flows\) the issued token
represents\. Stored as a raw [System\.Text\.Json\.Nodes\.JsonObject](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes.jsonobject 'System\.Text\.Json\.Nodes\.JsonObject') so nested delegation chains are
preserved byte\-exact through storage\. `null` for impersonation flows and for
non\-Token\-Exchange grants\.

```csharp
public System.Text.Json.Nodes.JsonObject? Actor { get; init; }
```

#### Property Value
[System\.Text\.Json\.Nodes\.JsonObject](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes.jsonobject 'System\.Text\.Json\.Nodes\.JsonObject')

## AuthorizationContext\.Audiences Property {#Abblix.Oidc.Server.Common.AuthorizationContext.Audiences}

RFC 8693 §2\.1 `audience` request parameter passed through to the issued token\. Logical
names of the relying party for which the requested token is intended\. Distinct from
[Resources](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.AuthorizationContext#Abblix.Oidc.Server.Common.AuthorizationContext.Resources 'Abblix\.Oidc\.Server\.Common\.AuthorizationContext\.Resources') \(RFC 8707 absolute URIs\); audience values are opaque strings\. JWT
emission folds both [Resources](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.AuthorizationContext#Abblix.Oidc.Server.Common.AuthorizationContext.Resources 'Abblix\.Oidc\.Server\.Common\.AuthorizationContext\.Resources') and `Audiences` into the `aud` claim\.

```csharp
public string[]? Audiences { get; init; }
```

#### Property Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array')

## AuthorizationContext\.AuthorizationDetails Property {#Abblix.Oidc.Server.Common.AuthorizationContext.AuthorizationDetails}

The RFC 9396 Rich Authorization Requests array stored as a raw [System\.Text\.Json\.Nodes\.JsonArray](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes.jsonarray 'System\.Text\.Json\.Nodes\.JsonArray')\.
This is the source of truth — preserved byte\-exact \(member order, type\-specific payload\)
through the authorize → code → token round\-trip and protobuf persistence, without lossy
typed deserialise / re\-serialise cycles\.

```csharp
public System.Text.Json.Nodes.JsonArray? AuthorizationDetails { get; init; }
```

#### Property Value
[System\.Text\.Json\.Nodes\.JsonArray](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes.jsonarray 'System\.Text\.Json\.Nodes\.JsonArray')

## AuthorizationContext\.CertificateSha256Thumbprint Property {#Abblix.Oidc.Server.Common.AuthorizationContext.CertificateSha256Thumbprint}

Base64url\-encoded SHA\-256 thumbprint of the client X\.509 certificate used at the token endpoint
for mutual TLS client authentication\. When present, access tokens carry a confirmation
claim \(`cnf`\) containing `x5t#S256` equal to this value \(RFC 8705 §3\.1\)\.

```csharp
public string? CertificateSha256Thumbprint { get; init; }
```

#### Property Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

## AuthorizationContext\.ClientId Property {#Abblix.Oidc.Server.Common.AuthorizationContext.ClientId}

The unique identifier for the client making the authorization request, as registered in the authorization server\.
This identifier is crucial for linking the authorization request and the issued tokens to a specific
client application\.

```csharp
public string ClientId { get; init; }
```

#### Property Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

## AuthorizationContext\.CodeChallenge Property {#Abblix.Oidc.Server.Common.AuthorizationContext.CodeChallenge}

The high\-entropy cryptographic string provided by the client, used in the PKCE \(Proof Key for Code Exchange\)
extension to secure the exchange of the authorization code for a token,
especially in public clients and mobile applications\.

```csharp
public string? CodeChallenge { get; init; }
```

#### Property Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

## AuthorizationContext\.CodeChallengeMethod Property {#Abblix.Oidc.Server.Common.AuthorizationContext.CodeChallengeMethod}

Specifies the transformation method applied to the 'code\_verifier' when generating the 'code\_challenge',
enhancing the security of PKCE by allowing the authorization server to verify the code exchange authenticity\.

```csharp
public string? CodeChallengeMethod { get; init; }
```

#### Property Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

## AuthorizationContext\.Nonce Property {#Abblix.Oidc.Server.Common.AuthorizationContext.Nonce}

A string value used to associate a client session with an ID Token, mitigating replay attacks by ensuring
that an ID Token cannot be used in a different context than the one it was intended for\.

```csharp
public string? Nonce { get; init; }
```

#### Property Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

## AuthorizationContext\.ProofKeyThumbprint Property {#Abblix.Oidc.Server.Common.AuthorizationContext.ProofKeyThumbprint}

RFC 7638 base64url\-encoded JWK thumbprint of the DPoP proof\-of\-possession key
bound to this authorization \(RFC 9449 §6\.1\)\. When present, access tokens carry a
`cnf.jkt` confirmation claim equal to this value, locking the token to the
specific key the client demonstrated control of at the token endpoint\.

```csharp
public string? ProofKeyThumbprint { get; init; }
```

#### Property Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

## AuthorizationContext\.RedirectUri Property {#Abblix.Oidc.Server.Common.AuthorizationContext.RedirectUri}

The URI where the authorization response should be sent\. This URI must match one of the registered redirects URI
for the client application, ensuring that authorization responses are delivered to the correct destination
securely\.

```csharp
public System.Uri? RedirectUri { get; init; }
```

#### Property Value
[System\.Uri](https://learn.microsoft.com/en-us/dotnet/api/system.uri 'System\.Uri')

## AuthorizationContext\.RequestedClaims Property {#Abblix.Oidc.Server.Common.AuthorizationContext.RequestedClaims}

Optional\. Specifies the individual Claims requested by the client, providing detailed instructions
for the authorization server on the Claims to be returned, either in the ID Token or via the UserInfo endpoint\.

```csharp
public Abblix.Oidc.Server.Model.RequestedClaims? RequestedClaims { get; init; }
```

#### Property Value
[RequestedClaims](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.RequestedClaims 'Abblix\.Oidc\.Server\.Model\.RequestedClaims')

## AuthorizationContext\.Resources Property {#Abblix.Oidc.Server.Common.AuthorizationContext.Resources}

The resources for which the authorization is granted\.
These resources are typically URIs that identify specific services or data that the client is authorized
to access\.

```csharp
public System.Uri[]? Resources { get; init; }
```

#### Property Value
[System\.Uri](https://learn.microsoft.com/en-us/dotnet/api/system.uri 'System\.Uri')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array')

## AuthorizationContext\.Scope Property {#Abblix.Oidc.Server.Common.AuthorizationContext.Scope}

Defines the scope of access requested by the client\. Scopes are used to specify the level of access or
permissions that the client is requesting on the user's behalf\.
They play a key role in enforcing the principle of least privilege\.

```csharp
public string[] Scope { get; init; }
```

#### Property Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array')

## AuthorizationContext\.X509CertificateSha256Thumbprint Property {#Abblix.Oidc.Server.Common.AuthorizationContext.X509CertificateSha256Thumbprint}

Legacy alias for [CertificateSha256Thumbprint](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.AuthorizationContext#Abblix.Oidc.Server.Common.AuthorizationContext.CertificateSha256Thumbprint 'Abblix\.Oidc\.Server\.Common\.AuthorizationContext\.CertificateSha256Thumbprint'): forwards to the same backing
storage so existing JSON blobs and downstream callers initialising this property still
resolve correctly, while the deprecation warning steers new code to the canonical name\.
The X509 prefix was dropped on the canonical name to align with the cnf\-member naming
used by [CertificateSha256Thumbprint](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebTokenConfirmation#Abblix.Jwt.JsonWebTokenConfirmation.CertificateSha256Thumbprint 'Abblix\.Jwt\.JsonWebTokenConfirmation\.CertificateSha256Thumbprint')\.

```csharp
public string? X509CertificateSha256Thumbprint { get; init; }
```

#### Property Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')
### Methods

## AuthorizationContext\.Deconstruct\(string, string\[\], RequestedClaims\) Method {#Abblix.Oidc.Server.Common.AuthorizationContext.Deconstruct(string,string[],Abblix.Oidc.Server.Model.RequestedClaims)}

Splits the authorization context into its constructor triple, enabling pattern\-style
destructuring at the call site\.

```csharp
public void Deconstruct(out string clientId, out string[] scope, out Abblix.Oidc.Server.Model.RequestedClaims? requestedClaims);
```
#### Parameters

###### `clientId` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Common.AuthorizationContext.Deconstruct(string,string[],Abblix.Oidc.Server.Model.RequestedClaims).clientId}

Receives the [ClientId](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.AuthorizationContext#Abblix.Oidc.Server.Common.AuthorizationContext.ClientId 'Abblix\.Oidc\.Server\.Common\.AuthorizationContext\.ClientId')\.

###### `scope` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') {#Abblix.Oidc.Server.Common.AuthorizationContext.Deconstruct(string,string[],Abblix.Oidc.Server.Model.RequestedClaims).scope}

Receives the [Scope](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.AuthorizationContext#Abblix.Oidc.Server.Common.AuthorizationContext.Scope 'Abblix\.Oidc\.Server\.Common\.AuthorizationContext\.Scope') array\.

###### `requestedClaims` [RequestedClaims](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.RequestedClaims 'Abblix\.Oidc\.Server\.Model\.RequestedClaims') {#Abblix.Oidc.Server.Common.AuthorizationContext.Deconstruct(string,string[],Abblix.Oidc.Server.Model.RequestedClaims).requestedClaims}

Receives the optional [RequestedClaims](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.AuthorizationContext#Abblix.Oidc.Server.Common.AuthorizationContext.RequestedClaims 'Abblix\.Oidc\.Server\.Common\.AuthorizationContext\.RequestedClaims')\.