/AWS1/CL_SISINTROSPECTO2TOKW01

Output structure for IntrospectOAuth2TokenWithIAM operation

RFC 7662 §2.2 introspection response. Only active is required; all other claims are omitted when the token is inactive.

CONSTRUCTOR

IMPORTING

Required arguments:

iv_active TYPE /AWS1/SISBOOLEAN /AWS1/SISBOOLEAN

Indicates whether the token is currently active. true only when the token is valid, has not expired, has not been revoked, and belongs to the caller's account.

Optional arguments:

iv_clientid TYPE /AWS1/SISSTRING /AWS1/SISSTRING

Client identifier for the OAuth 2.0 client that requested the token.

iv_userid TYPE /AWS1/SISSTRING /AWS1/SISSTRING

User identifier matching sts:GetCallerIdentity's UserId field for the token's subject principal (e.g. "AIDAEXAMPLE" for an IAM user, or "AROAEXAMPLE:session-name" for an assumed role).

iv_tokentype TYPE /AWS1/SISINTROSPECTEDTOKENTYPE /AWS1/SISINTROSPECTEDTOKENTYPE

Indicates which kind of token was introspected. One of "access_token" or "refresh_token".

iv_exp TYPE /AWS1/SISLONG /AWS1/SISLONG

Token expiration time as a NumericDate (Unix epoch seconds).

iv_iat TYPE /AWS1/SISLONG /AWS1/SISLONG

Token issuance time as a NumericDate (Unix epoch seconds).

iv_nbf TYPE /AWS1/SISLONG /AWS1/SISLONG

Token "not before" time as a NumericDate (Unix epoch seconds).

iv_sub TYPE /AWS1/SISSTRING /AWS1/SISSTRING

Subject of the token: the IAM principal ARN. For assumed-role sessions, this is the session ARN (matches sts:GetCallerIdentity's Arn field), e.g. arn:aws:sts::123456789012:assumed-role/MyRole/session-name.

iv_aud TYPE /AWS1/SISSTRING /AWS1/SISSTRING

Audience of the token: the OAuth resource the token is scoped to (for example, "aws-mcp.amazonaws.com"). Omitted for refresh tokens.

iv_iss TYPE /AWS1/SISSTRING /AWS1/SISSTRING

Issuer of the token. Always "signin.amazonaws.com" for AWS Sign-In.

iv_jti TYPE /AWS1/SISSTRING /AWS1/SISSTRING

Unique identifier for the token.

iv_accountid TYPE /AWS1/SISACCOUNTID /AWS1/SISACCOUNTID

12-digit AWS account ID of the token's subject principal.

iv_signinsession TYPE /AWS1/SISSTRING /AWS1/SISSTRING

AWS Sign-In session ARN bound to the token, of the form arn:aws:signin:{region}:{account}:session/{uuid}.

iv_resource TYPE /AWS1/SISSTRING /AWS1/SISSTRING

The OAuth resource the token is scoped to during Human OAuth flow. Only present for refresh token introspection.

---

Queryable Attributes

active

Indicates whether the token is currently active. true only when the token is valid, has not expired, has not been revoked, and belongs to the caller's account.

Accessible with the following methods

Method	Description
GET_ACTIVE()	Getter for ACTIVE, with configurable default
ASK_ACTIVE()	Getter for ACTIVE w/ exceptions if field has no value
HAS_ACTIVE()	Determine if ACTIVE has a value

clientId

Client identifier for the OAuth 2.0 client that requested the token.

Accessible with the following methods

Method	Description
GET_CLIENTID()	Getter for CLIENTID, with configurable default
ASK_CLIENTID()	Getter for CLIENTID w/ exceptions if field has no value
HAS_CLIENTID()	Determine if CLIENTID has a value

userId

User identifier matching sts:GetCallerIdentity's UserId field for the token's subject principal (e.g. "AIDAEXAMPLE" for an IAM user, or "AROAEXAMPLE:session-name" for an assumed role).

Accessible with the following methods

Method	Description
GET_USERID()	Getter for USERID, with configurable default
ASK_USERID()	Getter for USERID w/ exceptions if field has no value
HAS_USERID()	Determine if USERID has a value

tokenType

Indicates which kind of token was introspected. One of "access_token" or "refresh_token".

Accessible with the following methods

Method	Description
GET_TOKENTYPE()	Getter for TOKENTYPE, with configurable default
ASK_TOKENTYPE()	Getter for TOKENTYPE w/ exceptions if field has no value
HAS_TOKENTYPE()	Determine if TOKENTYPE has a value

exp

Token expiration time as a NumericDate (Unix epoch seconds).

Accessible with the following methods

Method	Description
GET_EXP()	Getter for EXP, with configurable default
ASK_EXP()	Getter for EXP w/ exceptions if field has no value
HAS_EXP()	Determine if EXP has a value

iat

Token issuance time as a NumericDate (Unix epoch seconds).

Accessible with the following methods

Method	Description
GET_IAT()	Getter for IAT, with configurable default
ASK_IAT()	Getter for IAT w/ exceptions if field has no value
HAS_IAT()	Determine if IAT has a value

nbf

Token "not before" time as a NumericDate (Unix epoch seconds).

Accessible with the following methods

Method	Description
GET_NBF()	Getter for NBF, with configurable default
ASK_NBF()	Getter for NBF w/ exceptions if field has no value
HAS_NBF()	Determine if NBF has a value

sub

Subject of the token: the IAM principal ARN. For assumed-role sessions, this is the session ARN (matches sts:GetCallerIdentity's Arn field), e.g. arn:aws:sts::123456789012:assumed-role/MyRole/session-name.

Accessible with the following methods

Method	Description
GET_SUB()	Getter for SUB, with configurable default
ASK_SUB()	Getter for SUB w/ exceptions if field has no value
HAS_SUB()	Determine if SUB has a value

aud

Audience of the token: the OAuth resource the token is scoped to (for example, "aws-mcp.amazonaws.com"). Omitted for refresh tokens.

Accessible with the following methods

Method	Description
GET_AUD()	Getter for AUD, with configurable default
ASK_AUD()	Getter for AUD w/ exceptions if field has no value
HAS_AUD()	Determine if AUD has a value

iss

Issuer of the token. Always "signin.amazonaws.com" for AWS Sign-In.

Accessible with the following methods

Method	Description
GET_ISS()	Getter for ISS, with configurable default
ASK_ISS()	Getter for ISS w/ exceptions if field has no value
HAS_ISS()	Determine if ISS has a value

jti

Unique identifier for the token.

Accessible with the following methods

Method	Description
GET_JTI()	Getter for JTI, with configurable default
ASK_JTI()	Getter for JTI w/ exceptions if field has no value
HAS_JTI()	Determine if JTI has a value

accountId

12-digit AWS account ID of the token's subject principal.

Accessible with the following methods

Method	Description
GET_ACCOUNTID()	Getter for ACCOUNTID, with configurable default
ASK_ACCOUNTID()	Getter for ACCOUNTID w/ exceptions if field has no value
HAS_ACCOUNTID()	Determine if ACCOUNTID has a value

signinSession

AWS Sign-In session ARN bound to the token, of the form arn:aws:signin:{region}:{account}:session/{uuid}.

Accessible with the following methods

Method	Description
GET_SIGNINSESSION()	Getter for SIGNINSESSION, with configurable default
ASK_SIGNINSESSION()	Getter for SIGNINSESSION w/ exceptions if field has no value
HAS_SIGNINSESSION()	Determine if SIGNINSESSION has a value

resource

The OAuth resource the token is scoped to during Human OAuth flow. Only present for refresh token introspection.

Accessible with the following methods

Method	Description
GET_RESOURCE()	Getter for RESOURCE, with configurable default
ASK_RESOURCE()	Getter for RESOURCE w/ exceptions if field has no value
HAS_RESOURCE()	Determine if RESOURCE has a value