#### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index')
### [Abblix\.Oidc\.Server\.Features\.TokenExchange](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.TokenExchange 'Abblix\.Oidc\.Server\.Features\.TokenExchange')

## SubjectTokenContext Class

The portable state extracted by an [ISubjectTokenResolver](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.TokenExchange.ISubjectTokenResolver 'Abblix\.Oidc\.Server\.Features\.TokenExchange\.ISubjectTokenResolver') from a wire\-level
`subject_token`\. Independent of the token's on\-wire format \-\- JWT\-based resolvers parse
the payload, opaque\-token resolvers recover the equivalent fields from a previously stored
grant\. The [TokenExchangeGrantHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants.TokenExchangeGrantHandler 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants\.TokenExchangeGrantHandler') consumes this record to
synthesise the new [AuthorizationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.AuthorizationContext 'Abblix\.Oidc\.Server\.Common\.AuthorizationContext') and
[AuthSession](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.UserAuthentication.AuthSession 'Abblix\.Oidc\.Server\.Features\.UserAuthentication\.AuthSession')\.

```csharp
public sealed record SubjectTokenContext : System.IEquatable<Abblix.Oidc.Server.Features.TokenExchange.SubjectTokenContext>
```

Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → SubjectTokenContext

Implements [System\.IEquatable&lt;](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')[SubjectTokenContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.TokenExchange.SubjectTokenContext 'Abblix\.Oidc\.Server\.Features\.TokenExchange\.SubjectTokenContext')[&gt;](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')
### Constructors

## SubjectTokenContext\(string, string, string\[\], JsonArray\) Constructor {#Abblix.Oidc.Server.Features.TokenExchange.SubjectTokenContext.SubjectTokenContext(string,string,string[],System.Text.Json.Nodes.JsonArray)}

The portable state extracted by an [ISubjectTokenResolver](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.TokenExchange.ISubjectTokenResolver 'Abblix\.Oidc\.Server\.Features\.TokenExchange\.ISubjectTokenResolver') from a wire\-level
`subject_token`\. Independent of the token's on\-wire format \-\- JWT\-based resolvers parse
the payload, opaque\-token resolvers recover the equivalent fields from a previously stored
grant\. The [TokenExchangeGrantHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants.TokenExchangeGrantHandler 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants\.TokenExchangeGrantHandler') consumes this record to
synthesise the new [AuthorizationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.AuthorizationContext 'Abblix\.Oidc\.Server\.Common\.AuthorizationContext') and
[AuthSession](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.UserAuthentication.AuthSession 'Abblix\.Oidc\.Server\.Features\.UserAuthentication\.AuthSession')\.

```csharp
public SubjectTokenContext(string Subject, string? Issuer, string[]? Scope, System.Text.Json.Nodes.JsonArray? AuthorizationDetails);
```
#### Parameters

###### `Subject` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Features.TokenExchange.SubjectTokenContext.SubjectTokenContext(string,string,string[],System.Text.Json.Nodes.JsonArray).Subject}

The end\-user identifier the subject\_token represents \(RFC 7519 `sub`
            claim or its opaque\-token equivalent\)\. Required\.

###### `Issuer` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Features.TokenExchange.SubjectTokenContext.SubjectTokenContext(string,string,string[],System.Text.Json.Nodes.JsonArray).Issuer}

The party that issued the subject\_token, used as the
            `IdentityProvider` on the synthesised `AuthSession`\. `null` when the resolver
            cannot determine it \(e\.g\. opaque tokens without an issuer field\)\.

###### `Scope` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') {#Abblix.Oidc.Server.Features.TokenExchange.SubjectTokenContext.SubjectTokenContext(string,string,string[],System.Text.Json.Nodes.JsonArray).Scope}

Scopes the subject\_token was granted\. The grant handler intersects this
            with any `scope` the client supplied in the exchange request \(RFC 8693 §2\.1 narrow
            only \-\- never widen\)\. `null` when the subject\_token did not carry a scope claim\.

###### `AuthorizationDetails` [System\.Text\.Json\.Nodes\.JsonArray](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes.jsonarray 'System\.Text\.Json\.Nodes\.JsonArray') {#Abblix.Oidc.Server.Features.TokenExchange.SubjectTokenContext.SubjectTokenContext(string,string,string[],System.Text.Json.Nodes.JsonArray).AuthorizationDetails}

RFC 9396 `authorization_details` attached to the
            subject\_token, raw [System\.Text\.Json\.Nodes\.JsonArray](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes.jsonarray 'System\.Text\.Json\.Nodes\.JsonArray') so the byte\-exact payload survives the exchange
            into the issued token\. `null` when the subject\_token did not carry AD\.
### Properties

## SubjectTokenContext\.Act Property {#Abblix.Oidc.Server.Features.TokenExchange.SubjectTokenContext.Act}

RFC 8693 §4\.1 `act` claim attached to the subject\_token, captured as
            a raw [System\.Text\.Json\.Nodes\.JsonObject](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes.jsonobject 'System\.Text\.Json\.Nodes\.JsonObject')\. When the exchange adds a new actor on top of a subject\_token
            that already had its own act chain, the grant handler nests this value under the new actor's
            `act` member so the full delegation chain is preserved\. `null` when the
            subject\_token was not itself a delegation token\.

```csharp
public System.Text.Json.Nodes.JsonObject? Act { get; init; }
```

#### Property Value
[System\.Text\.Json\.Nodes\.JsonObject](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes.jsonobject 'System\.Text\.Json\.Nodes\.JsonObject')

## SubjectTokenContext\.AuthorizationDetails Property {#Abblix.Oidc.Server.Features.TokenExchange.SubjectTokenContext.AuthorizationDetails}

RFC 9396 `authorization_details` attached to the
            subject\_token, raw [System\.Text\.Json\.Nodes\.JsonArray](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes.jsonarray 'System\.Text\.Json\.Nodes\.JsonArray') so the byte\-exact payload survives the exchange
            into the issued token\. `null` when the subject\_token did not carry AD\.

```csharp
public System.Text.Json.Nodes.JsonArray? AuthorizationDetails { get; init; }
```

#### Property Value
[System\.Text\.Json\.Nodes\.JsonArray](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes.jsonarray 'System\.Text\.Json\.Nodes\.JsonArray')

## SubjectTokenContext\.Issuer Property {#Abblix.Oidc.Server.Features.TokenExchange.SubjectTokenContext.Issuer}

The party that issued the subject\_token, used as the
            `IdentityProvider` on the synthesised `AuthSession`\. `null` when the resolver
            cannot determine it \(e\.g\. opaque tokens without an issuer field\)\.

```csharp
public string? Issuer { get; init; }
```

#### Property Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

## SubjectTokenContext\.JwtTokenType Property {#Abblix.Oidc.Server.Features.TokenExchange.SubjectTokenContext.JwtTokenType}

For JWT\-formatted subject\_tokens, the value of the JWS `typ` header \(e\.g\. `at+jwt`,
`id+jwt`, `rt+jwt`\)\. The grant handler uses this to detect cross\-type confusion \-\-
a JWT minted as an id\_token presented under `subject_token_type=access_token` is
rejected even though both pass signature validation\. `null` when the subject\_token is
not a JWT or the typ header was absent\.

```csharp
public string? JwtTokenType { get; init; }
```

#### Property Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

## SubjectTokenContext\.OriginalClientId Property {#Abblix.Oidc.Server.Features.TokenExchange.SubjectTokenContext.OriginalClientId}

The `client_id` the subject\_token was originally issued to\. The grant handler uses this
to detect cross\-client exchange attempts \(Client B presenting a token issued to Client A\),
which is rejected by default to prevent a confused\-deputy escalation\. `null` when the
resolver cannot determine the original client \(e\.g\. opaque tokens without a client\_id field
or pre\-cross\-client\-check tokens\)\.

```csharp
public string? OriginalClientId { get; init; }
```

#### Property Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

## SubjectTokenContext\.Scope Property {#Abblix.Oidc.Server.Features.TokenExchange.SubjectTokenContext.Scope}

Scopes the subject\_token was granted\. The grant handler intersects this
            with any `scope` the client supplied in the exchange request \(RFC 8693 §2\.1 narrow
            only \-\- never widen\)\. `null` when the subject\_token did not carry a scope claim\.

```csharp
public string[]? Scope { get; init; }
```

#### Property Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array')

## SubjectTokenContext\.Subject Property {#Abblix.Oidc.Server.Features.TokenExchange.SubjectTokenContext.Subject}

The end\-user identifier the subject\_token represents \(RFC 7519 `sub`
            claim or its opaque\-token equivalent\)\. Required\.

```csharp
public string Subject { get; init; }
```

#### Property Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')