class Aws::Signin::Types::IntrospectOAuth2TokenWithIAMResponse

@see docs.aws.amazon.com/goto/WebAPI/signin-2023-01-01/IntrospectOAuth2TokenWithIAMResponse AWS API Documentation
@return [String]
Only present for refresh token introspection.
The OAuth resource the token is scoped to during Human OAuth flow.
@!attribute [rw] resource
@return [String]
arn:aws:signin:{region}:{account}:session/{uuid}.
AWS Sign-In session ARN bound to the token, of the form
@!attribute [rw] signin_session
@return [String]
12-digit AWS account ID of the token’s subject principal.
@!attribute [rw] account_id
@return [String]
Unique identifier for the token.
@!attribute [rw] jti
@return [String]
Issuer of the token. Always “signin.amazonaws.com” for AWS Sign-In.
@!attribute [rw] iss
@return [String]
(for example, “aws-mcp.amazonaws.com”). Omitted for refresh tokens.
Audience of the token: the OAuth resource the token is scoped to
@!attribute [rw] aud
@return [String]
arn:aws:sts::123456789012:assumed-role/MyRole/session-name.
‘Arn` field), e.g.
sessions, this is the session ARN (matches sts:GetCallerIdentity’s
Subject of the token: the IAM principal ARN. For assumed-role
@!attribute [rw] sub
@return [Integer]
Token “not before” time as a NumericDate (Unix epoch seconds).
@!attribute [rw] nbf
@return [Integer]
Token issuance time as a NumericDate (Unix epoch seconds).
@!attribute [rw] iat
@return [Integer]
Token expiration time as a NumericDate (Unix epoch seconds).
@!attribute [rw] exp
@return [String]
“access_token” or “refresh_token”.
Indicates which kind of token was introspected. One of
@!attribute [rw] token_type
@return [String]
or “AROAEXAMPLE:session-name” for an assumed role).
the token’s subject principal (e.g. “AIDAEXAMPLE” for an IAM user,
User identifier matching sts:GetCallerIdentity’s ‘UserId` field for
@!attribute [rw] user_id
@return [String]
Client identifier for the OAuth 2.0 client that requested the token.
@!attribute [rw] client_id
@return [Boolean]
belongs to the caller’s account.
the token is valid, has not expired, has not been revoked, and
Indicates whether the token is currently active. ‘true` only when
@!attribute [rw] active
other claims are omitted when the token is inactive.
RFC 7662 §2.2 introspection response. Only `active` is required; all
Output structure for IntrospectOAuth2TokenWithIAM operation