#### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index')
### [Abblix\.Oidc\.Server\.Features\.TokenExchange](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.TokenExchange 'Abblix\.Oidc\.Server\.Features\.TokenExchange')

## RefreshTokenSubjectTokenResolver Class

[ISubjectTokenResolver](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.TokenExchange.ISubjectTokenResolver 'Abblix\.Oidc\.Server\.Features\.TokenExchange\.ISubjectTokenResolver') for the `urn:ietf:params:oauth:token-type:refresh_token`
            subject type\. Refresh tokens issued by this AS are JWT\-formatted with `typ=rt+jwt`; the
            resolver validates the JWT, enforces the typ header, and recovers the original
            [AuthorizedGrant](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.AuthorizedGrant') via
            [AuthorizeByRefreshTokenAsync\(JsonWebToken\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Tokens.IRefreshTokenService#Abblix.Oidc.Server.Features.Tokens.IRefreshTokenService.AuthorizeByRefreshTokenAsync(Abblix.Jwt.JsonWebToken) 'Abblix\.Oidc\.Server\.Features\.Tokens\.IRefreshTokenService\.AuthorizeByRefreshTokenAsync\(Abblix\.Jwt\.JsonWebToken\)')\. The grant's subject, scope,
            and `authorization_details` become the exchanged token's starting point\.

```csharp
public sealed class RefreshTokenSubjectTokenResolver : Abblix.Oidc.Server.Features.TokenExchange.ISubjectTokenResolver
```

Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → RefreshTokenSubjectTokenResolver

Implements [ISubjectTokenResolver](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.TokenExchange.ISubjectTokenResolver 'Abblix\.Oidc\.Server\.Features\.TokenExchange\.ISubjectTokenResolver')

### Remarks
Unlike [JwtSubjectTokenResolver](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.TokenExchange.JwtSubjectTokenResolver 'Abblix\.Oidc\.Server\.Features\.TokenExchange\.JwtSubjectTokenResolver'), this implementation also touches refresh\-token
storage \-\- the wire\-level string by itself is not enough to recover the issued scope and AD,
since the JWT's payload carries only the identifying minimum \(jti, exp, sub\)\. The lookup
service additionally enforces single\-use / rotation semantics in environments that opt in
to refresh\-token rotation, so a token already redeemed will reject here exactly as it would
in the refresh\_token grant\.
### Constructors

## RefreshTokenSubjectTokenResolver\(IAuthServiceJwtValidator, IRefreshTokenService\) Constructor {#Abblix.Oidc.Server.Features.TokenExchange.RefreshTokenSubjectTokenResolver.RefreshTokenSubjectTokenResolver(Abblix.Oidc.Server.Features.Tokens.Validation.IAuthServiceJwtValidator,Abblix.Oidc.Server.Features.Tokens.IRefreshTokenService)}

[ISubjectTokenResolver](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.TokenExchange.ISubjectTokenResolver 'Abblix\.Oidc\.Server\.Features\.TokenExchange\.ISubjectTokenResolver') for the `urn:ietf:params:oauth:token-type:refresh_token`
            subject type\. Refresh tokens issued by this AS are JWT\-formatted with `typ=rt+jwt`; the
            resolver validates the JWT, enforces the typ header, and recovers the original
            [AuthorizedGrant](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.AuthorizedGrant') via
            [AuthorizeByRefreshTokenAsync\(JsonWebToken\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Tokens.IRefreshTokenService#Abblix.Oidc.Server.Features.Tokens.IRefreshTokenService.AuthorizeByRefreshTokenAsync(Abblix.Jwt.JsonWebToken) 'Abblix\.Oidc\.Server\.Features\.Tokens\.IRefreshTokenService\.AuthorizeByRefreshTokenAsync\(Abblix\.Jwt\.JsonWebToken\)')\. The grant's subject, scope,
            and `authorization_details` become the exchanged token's starting point\.

```csharp
public RefreshTokenSubjectTokenResolver(Abblix.Oidc.Server.Features.Tokens.Validation.IAuthServiceJwtValidator jwtValidator, Abblix.Oidc.Server.Features.Tokens.IRefreshTokenService refreshTokenService);
```
#### Parameters

###### `jwtValidator` [IAuthServiceJwtValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Tokens.Validation.IAuthServiceJwtValidator 'Abblix\.Oidc\.Server\.Features\.Tokens\.Validation\.IAuthServiceJwtValidator') {#Abblix.Oidc.Server.Features.TokenExchange.RefreshTokenSubjectTokenResolver.RefreshTokenSubjectTokenResolver(Abblix.Oidc.Server.Features.Tokens.Validation.IAuthServiceJwtValidator,Abblix.Oidc.Server.Features.Tokens.IRefreshTokenService).jwtValidator}

Validates the refresh\-token JWT's signature and lifetime\.

###### `refreshTokenService` [IRefreshTokenService](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Tokens.IRefreshTokenService 'Abblix\.Oidc\.Server\.Features\.Tokens\.IRefreshTokenService') {#Abblix.Oidc.Server.Features.TokenExchange.RefreshTokenSubjectTokenResolver.RefreshTokenSubjectTokenResolver(Abblix.Oidc.Server.Features.Tokens.Validation.IAuthServiceJwtValidator,Abblix.Oidc.Server.Features.Tokens.IRefreshTokenService).refreshTokenService}

Resolves the JWT to the original authorised grant\.

### Remarks
Unlike [JwtSubjectTokenResolver](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.TokenExchange.JwtSubjectTokenResolver 'Abblix\.Oidc\.Server\.Features\.TokenExchange\.JwtSubjectTokenResolver'), this implementation also touches refresh\-token
storage \-\- the wire\-level string by itself is not enough to recover the issued scope and AD,
since the JWT's payload carries only the identifying minimum \(jti, exp, sub\)\. The lookup
service additionally enforces single\-use / rotation semantics in environments that opt in
to refresh\-token rotation, so a token already redeemed will reject here exactly as it would
in the refresh\_token grant\.
### Methods

## RefreshTokenSubjectTokenResolver\.ResolveAsync\(string, CancellationToken\) Method {#Abblix.Oidc.Server.Features.TokenExchange.RefreshTokenSubjectTokenResolver.ResolveAsync(string,System.Threading.CancellationToken)}

Parses or looks up the wire\-level [subjectToken](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.TokenExchange.RefreshTokenSubjectTokenResolver#Abblix.Oidc.Server.Features.TokenExchange.RefreshTokenSubjectTokenResolver.ResolveAsync(string,System.Threading.CancellationToken).subjectToken 'Abblix\.Oidc\.Server\.Features\.TokenExchange\.RefreshTokenSubjectTokenResolver\.ResolveAsync\(string, System\.Threading\.CancellationToken\)\.subjectToken') and returns the
portable subject context on success, or an [OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError') on failure\.

```csharp
public System.Threading.Tasks.Task<Abblix.Utils.Result<Abblix.Oidc.Server.Features.TokenExchange.SubjectTokenContext,Abblix.Oidc.Server.Common.OidcError>> ResolveAsync(string subjectToken, System.Threading.CancellationToken cancellationToken);
```
#### Parameters

###### `subjectToken` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Features.TokenExchange.RefreshTokenSubjectTokenResolver.ResolveAsync(string,System.Threading.CancellationToken).subjectToken}

The exact `subject_token` string from the wire\.

###### `cancellationToken` [System\.Threading\.CancellationToken](https://learn.microsoft.com/en-us/dotnet/api/system.threading.cancellationtoken 'System\.Threading\.CancellationToken') {#Abblix.Oidc.Server.Features.TokenExchange.RefreshTokenSubjectTokenResolver.ResolveAsync(string,System.Threading.CancellationToken).cancellationToken}

Cancellation token\.

Implements [ResolveAsync\(string, CancellationToken\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.TokenExchange.ISubjectTokenResolver#Abblix.Oidc.Server.Features.TokenExchange.ISubjectTokenResolver.ResolveAsync(string,System.Threading.CancellationToken) 'Abblix\.Oidc\.Server\.Features\.TokenExchange\.ISubjectTokenResolver\.ResolveAsync\(string, System\.Threading\.CancellationToken\)')

#### Returns
[System\.Threading\.Tasks\.Task&lt;](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[Abblix\.Utils\.Result&lt;](https://learn.microsoft.com/en-us/dotnet/api/abblix.utils.result-2 'Abblix\.Utils\.Result\`2')[SubjectTokenContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.TokenExchange.SubjectTokenContext 'Abblix\.Oidc\.Server\.Features\.TokenExchange\.SubjectTokenContext')[,](https://learn.microsoft.com/en-us/dotnet/api/abblix.utils.result-2 'Abblix\.Utils\.Result\`2')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[&gt;](https://learn.microsoft.com/en-us/dotnet/api/abblix.utils.result-2 'Abblix\.Utils\.Result\`2')[&gt;](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')  
The resolved subject context on success; an OIDC error describing the
            rejection reason on failure\. The handler maps every failure to wire\-level
            `invalid_request` per RFC 8693 §2\.2\.2\.