SecurityEventToken Class
A Security Event Token (SET): a JWT whose claims describe one or more aspects of a security event that occurred to a subject (RFC 8417 Section 2). This type is a typed view over the underlying JsonWebToken, naming the claims the SET profile gives meaning to.
public sealed class SecurityEventTokenInheritance System.Object → SecurityEventToken
Remarks
The view asserts nothing about conformance. Whether a given token IS a valid SET - carries the right "typ", a non-empty "events" claim, no "exp" - is the validation pipeline's verdict, not a property of this wrapper: a token read off the wire keeps whatever shape it arrived in until validated. SecurityEventTokenBuilder produces conformant instances by construction.
Constructors
SecurityEventToken(JsonWebToken) Constructor
A Security Event Token (SET): a JWT whose claims describe one or more aspects of a security event that occurred to a subject (RFC 8417 Section 2). This type is a typed view over the underlying JsonWebToken, naming the claims the SET profile gives meaning to.
public SecurityEventToken(Abblix.Jwt.JsonWebToken token);Parameters
token JsonWebToken
The token to view. Its claims are read in place, never copied.
Remarks
The view asserts nothing about conformance. Whether a given token IS a valid SET - carries the right "typ", a non-empty "events" claim, no "exp" - is the validation pipeline's verdict, not a property of this wrapper: a token read off the wire keeps whatever shape it arrived in until validated. SecurityEventTokenBuilder produces conformant instances by construction.
Fields
SecurityEventToken.TokenType Field
The "typ" header value declaring a JWT to be a SET. RFC 8417 Section 2.3 registers the "application/secevent+jwt" media type and, per RFC 7515 Section 4.1.9, recommends omitting the "application/" prefix in the header, so the value used SHOULD be "secevent+jwt". An alias into the core's shared registry, kept here because the value is a property of THIS token type and reads that way at call sites.
public const string TokenType = "secevent+jwt";Field Value
Properties
SecurityEventToken.Audiences Property
The "aud" claim: the audiences the SET is intended for. RECOMMENDED (RFC 8417 Section 2.2).
public System.Collections.Generic.IEnumerable<string> Audiences { get; }Property Value
System.Collections.Generic.IEnumerable<System.String>
SecurityEventToken.Events Property
The "events" claim: the event statements this SET expresses, keyed by event identifier URI. Null when the claim is absent or is not a JSON object - a shape for the validation pipeline to reject, not for this view to repair.
public Abblix.SecurityEvents.EventsCollection? Events { get; }Property Value
Remarks
The view is a read-through wrapper cached per underlying node, so repeated reads cost nothing and a claim replaced wholesale still yields a fresh view over the new node.
SecurityEventToken.IssuedAt Property
The "iat" claim: when the SET was issued. REQUIRED (RFC 8417 Section 2.2). Null on a token the validation pipeline has passed means the claim is absent, which the pipeline refuses; on a token constructed outside it, null may also mean a value the payload cannot read.
public System.Nullable<System.DateTimeOffset> IssuedAt { get; }Property Value
System.Nullable<System.DateTimeOffset>
SecurityEventToken.Issuer Property
The "iss" claim: the service provider publishing the SET. REQUIRED (RFC 8417 Section 2.2), and not necessarily the issuer of the security subject - the two coincide only when a profile says so.
public string? Issuer { get; }Property Value
SecurityEventToken.JwtId Property
The "jti" claim: the SET's unique identifier, unique within a particular event feed, by which a recipient can tell a redelivery from a new event. REQUIRED (RFC 8417 Section 2.2).
public string? JwtId { get; }Property Value
SecurityEventToken.Subject Property
The "sub" claim: the principal the SET is about. OPTIONAL (RFC 8417 Section 2.2) - many profiles identify the subject inside the event payload instead, which is where the Subject Identifiers of RFC 9493 live.
public string? Subject { get; }Property Value
SecurityEventToken.TimeOfEvent Property
The "toe" claim: when the event itself occurred, as opposed to when the SET about it was issued. OPTIONAL (RFC 8417 Section 2.2): by omitting it, the issuer declines to share an event time, and the value may be approximate where a profile says so. Null on a token a pipeline including TimeOfEventStep has passed means exactly that omission, since that step refuses a value it cannot read; on a token constructed outside such a pipeline, null may also mean such a value.
public System.Nullable<System.DateTimeOffset> TimeOfEvent { get; }Property Value
System.Nullable<System.DateTimeOffset>
SecurityEventToken.Token Property
The underlying JWT, for everything the SET profile does not name: header parameters, profile-specific envelope claims, serialization.
public Abblix.Jwt.JsonWebToken Token { get; }Property Value
SecurityEventToken.TransactionId Property
The "txn" claim: a transaction identifier correlating this SET with other JWTs issued for the same transaction. OPTIONAL (RFC 8417 Section 2.2).
public string? TransactionId { get; }Property Value
Methods
SecurityEventToken.GetSubjectId(JsonSerializerOptions) Method
Reads the "sub_id" claim: the Subject Identifier of the principal the SET is about (RFC 9493 Section 4.2). Null when the claim is absent.
public Abblix.SecurityEvents.Subjects.SubjectIdentifier? GetSubjectId(System.Text.Json.JsonSerializerOptions? serializerOptions=null);Parameters
serializerOptions System.Text.Json.JsonSerializerOptions
Options whose converters extend the RFC 9493 registered formats, typically a SubjectIdentifierJsonConverter built with a profile's custom-formats map; null reads the registered formats alone.
Returns
Exceptions
System.Text.Json.JsonException
The claim is present but is not a Subject Identifier the options understand.
Remarks
A method rather than a property, because interpreting the claim is real work whose outcome depends on the options: a profile teaching the converter extra Identifier Formats passes them here, and a document naming a format the options do not know fails as malformed rather than being repaired - the same posture the rest of this view takes.