#### [Abblix\.SecurityEvents](https://www.abblix.com/en/docs/api/abblix-securityevents 'index')
### [Abblix\.SecurityEvents\.Validation](https://www.abblix.com/en/docs/api/abblix-securityevents/Abblix.SecurityEvents.Validation 'Abblix\.SecurityEvents\.Validation')

## SecurityEventTokenValidationOptions Class

What one validation run expects of the token: the per\-call half of the receiver's
configuration, as opposed to the pipeline composition and key resolution, which are wired
once\.

```csharp
public record SecurityEventTokenValidationOptions : System.IEquatable<Abblix.SecurityEvents.Validation.SecurityEventTokenValidationOptions>
```

Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → SecurityEventTokenValidationOptions

Derived  
↳ [BackChannelLogoutValidationOptions](https://www.abblix.com/en/docs/api/abblix-securityevents/Abblix.SecurityEvents.BackChannelLogout.BackChannelLogoutValidationOptions 'Abblix\.SecurityEvents\.BackChannelLogout\.BackChannelLogoutValidationOptions')

Implements [System\.IEquatable&lt;](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')[SecurityEventTokenValidationOptions](https://www.abblix.com/en/docs/api/abblix-securityevents/Abblix.SecurityEvents.Validation.SecurityEventTokenValidationOptions 'Abblix\.SecurityEvents\.Validation\.SecurityEventTokenValidationOptions')[&gt;](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')
### Properties

## SecurityEventTokenValidationOptions\.ExpectedAudience Property {#Abblix.SecurityEvents.Validation.SecurityEventTokenValidationOptions.ExpectedAudience}

The audience value under which this receiver expects to be named in the "aud" claim\.
Required by the default pipeline's audience step; a profile that removes that step may
leave it null\.

```csharp
public string? ExpectedAudience { get; init; }
```

#### Property Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

## SecurityEventTokenValidationOptions\.ExpectedIssuers Property {#Abblix.SecurityEvents.Validation.SecurityEventTokenValidationOptions.ExpectedIssuers}

The issuers this receiver accepts events from\. An empty set accepts nobody \- the safe
reading of an unconfigured receiver \- and the issuer step reports any other issuer as
unknown\.

```csharp
public System.Collections.Generic.IReadOnlyCollection<string> ExpectedIssuers { get; init; }
```

#### Property Value
[System\.Collections\.Generic\.IReadOnlyCollection&lt;](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ireadonlycollection-1 'System\.Collections\.Generic\.IReadOnlyCollection\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[&gt;](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ireadonlycollection-1 'System\.Collections\.Generic\.IReadOnlyCollection\`1')

## SecurityEventTokenValidationOptions\.IssuedAtTolerance Property {#Abblix.SecurityEvents.Validation.SecurityEventTokenValidationOptions.IssuedAtTolerance}

How far a token's "iat" may lie from the receiver's clock, in either direction: the same
window forgives clock skew for a token from the near future and bounds staleness for one
from the past\. The bound matters beyond hygiene \- a replay cache tracking received "jti"
values \(RFC 8417 Section 2\.2 names that use\) can evict entries older than the window
instead of remembering every identifier forever, because anything older fails here first\.

```csharp
public System.TimeSpan IssuedAtTolerance { get; init; }
```

#### Property Value
[System\.TimeSpan](https://learn.microsoft.com/en-us/dotnet/api/system.timespan 'System\.TimeSpan')

## SecurityEventTokenValidationOptions\.ReplayRetention Property {#Abblix.SecurityEvents.Validation.SecurityEventTokenValidationOptions.ReplayRetention}

How long past a token's issue time its identifier stays in the replay cache\. It must
cover [IssuedAtTolerance](https://www.abblix.com/en/docs/api/abblix-securityevents/Abblix.SecurityEvents.Validation.SecurityEventTokenValidationOptions#Abblix.SecurityEvents.Validation.SecurityEventTokenValidationOptions.IssuedAtTolerance 'Abblix\.SecurityEvents\.Validation\.SecurityEventTokenValidationOptions\.IssuedAtTolerance') with a margin, because an identifier forgotten
while its token still passes the freshness window above is an identifier that token can
replay on\. The default doubles the default tolerance, and raising one without the other
is the mistake this pairing is written side by side to prevent\.

```csharp
public System.TimeSpan ReplayRetention { get; init; }
```

#### Property Value
[System\.TimeSpan](https://learn.microsoft.com/en-us/dotnet/api/system.timespan 'System\.TimeSpan')