---
title: Configuring identity hint contract
description: You can configure the identity hint contract, which contains the set of attributes received in the client initiated backchannel authentication (CIBA) request that identifies the user.
component: pingfederate
version: 13.1
page_id: pingfederate:administrators_reference_guide:help_cibapolicymanagementtasklet_cibapolicyrequesthintcontractstate
canonical_url: https://docs.pingidentity.com/pingfederate/13.1/administrators_reference_guide/help_cibapolicymanagementtasklet_cibapolicyrequesthintcontractstate.html
llms_txt: https://docs.pingidentity.com/pingfederate/llms.txt
docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md
revdate: July 5, 2022
section_ids:
  about-this-task: About this task
  steps: Steps
  example: Example
  related-links: Related links
---

# Configuring identity hint contract

You can configure the identity hint contract, which contains the set of attributes received in the client initiated backchannel authentication (CIBA) request that identifies the user.

## About this task

`IDENTITY_HINT_SUBJECT` is a core attribute and is automatically populated by the `sub` attribute of an identity hint token, if found, or the attribute value of the `login_hint` request attribute.

A client can send an ID token, `id_token_hint`, or a login hint token, `login_hint_token`, as the identity hint token. If you extend the identity hint contract with attribute names from the identity token, PingFederate fulfills them with values found in the identity token.

|   |                                                                                                                      |
| - | -------------------------------------------------------------------------------------------------------------------- |
|   | As needed, all attributes can optionally be fulfilled differently on the **Identity Hint Contract Fulfillment** tab. |

## Steps

1. (Optional) Go to **Applications > OAuth > CIBA Request Policies**. On the **Identity Hint Contract Fulfillment** tab, enter an attribute name under **Extend the Contract**, and then click **Add**.

2. Repeat the previous step to define additional attributes. Click **Next**.

   Use the **Edit**, **Update**, and **Cancel** workflow to make or undo a change to an existing entry. Click **Delete** to remove an entry.

## Example

Example

Suppose the following JSON web token (JWT) matches the expected structure of the login hint tokens.

```json
{
  "sub": "asmith",
  "attrs": {
    "mail": "asmith@example.com",
    "phone": "555-555-5555"
  }
}
```

To add both the `mail` and `phone` attributes, extend the contract with `login_hint_token.attrs.mail` and `login_hint_token.attrs.phone`, respectively.

## Related links

* [Client-initiated backchannel authentication endpoint](../developers_reference_guide/pf_ciba_endpoint.html)