API security gateway policy request attributes

access_token

String

Returns the access token from the client request.

active

Boolean

Indicates whether this access token is currently active, as determined by the access token validator.

audience

String[]

Returns the recipients for whom the access token is intended. Typically, the authorization server sets this field to identify the resource servers that can accept the token.

authentication_age

Number

Returns the number of seconds since the end user was authenticated by the token issuer.

This attribute uses the System Current DateTime resolver and a SpEL processor to calculate the number of seconds since the authentication_time. This calculation requires the auth_time claim in the access token.

authentication_policy

String

Returns the authentication policy that was satisfied when the access token was issued. An authentication policy is also called an authentication context class reference (ACR).

If the access token contains an acr claim, this attribute uses a JSON Path processor to extract the date and time from the HttpRequest.AccessToken attribute.

authentication_time

Zoned Date Time

Returns the date and time when the end user was authenticated.

If the access token contains an auth_time claim, this attribute uses a JSON Path processor to extract the date and time from the HttpRequest.AccessToken attribute. If the claim is missing from the token, the default value is January 1, 1970.

client_id

String

Returns the client ID of the application that was granted the access token.

expiration

DateTime

Returns the date and time at which the access token expired.

issued_at

DateTime

Returns the date and time at which the access token was issued.

issuer

String

Returns the token issuer.

Typically, this value is a URI that identifies the authorization server.

not_before

DateTime

Returns the date and time before which a resource server doesn’t accept an access token.

scope

Collection

Returns the list of scopes granted to this token.

subject

String

Returns the token subject.

This value represents a user identifier set by the authorization server.

token_owner

String

Returns the user identifier resolved by the access token validator’s token resource lookup method.

This value is a SCIM ID of the form <resource type>/<resource ID>.

token_type

String

Returns the token type set by the authorization server.

Typically, this value is bearer.

user_token

Boolean

Returns a flag set by the access token validator to indicate whether the token includes a subject. When this flag is false, the token contains no subject and was issued directly to a client.

username

String

Returns the subject’s user name.

This value represents a user identifier set by the authorization server.

algorithm

String

Returns the name of the certificate signature algorithm, such as SHA256withRSA.

algorithmOID

String

Returns the signature algorithm OID.

issuer

String

Returns the distinguished name (DN) of the certificate issuer.

notAfter

DateTime

Returns the expiration date and time of the certificate.

notBefore

DateTime

Returns the earliest date on which the certificate is considered valid.

subject

String

Returns the DN of the certificate subject.

subjectRegex

String

Returns the regular expression that must be matched by the subject field of the certificate to ensure the certificate belongs to the requesting client.

valid

Boolean

Indicates whether the SSL client certificate is valid.