Package ai.vectros.resources.auth.requests

Interface TokenExchangeRequest._FinalStage

All Known Implementing Classes:
TokenExchangeRequest.Builder
Enclosing class:
TokenExchangeRequest
public static interface TokenExchangeRequest._FinalStage

  • Method Details

    • build

      TokenExchangeRequest build()

    • additionalProperty

      TokenExchangeRequest._FinalStage additionalProperty(String key, Object value)

    • additionalProperties

      TokenExchangeRequest._FinalStage additionalProperties(Map<String,Object> additionalProperties)

    • requestedTokenType

      TokenExchangeRequest._FinalStage requestedTokenType(Optional<String> requestedTokenType)

      Accepted-and-ignored if present (this contract mints exactly one token shape). Optional.

    • requestedTokenType

      TokenExchangeRequest._FinalStage requestedTokenType(String requestedTokenType)

    • inviteToken

      TokenExchangeRequest._FinalStage inviteToken(Optional<String> inviteToken)

      The inv_* invitation token from a sub-user invite email, when this exchange is a first-time login for a subject with no existing Vectros identity yet (TOKEN-EXCHANGE-CONTRACT.md §6). Not part of RFC 8693 — a Vectros-specific extension field, additive to the standard grant. Omit for a subject that already has an active Vectros identity; required to complete first login for one that doesn't. Delivered to the end user out-of-band (the same invite-email link flow as today), never generated by this endpoint.

    • inviteToken

      TokenExchangeRequest._FinalStage inviteToken(String inviteToken)

    • signupType

      TokenExchangeRequest._FinalStage signupType(Optional<String> signupType)

      Selects which self-service signup policy to apply for a first-time login with NO invite token, when the registered issuer declares one or more selfSignupPolicies (POST /v1/auth/issuers). A plain client-supplied selector, not a value your identity provider needs to assert. Omit when the issuer has exactly one policy entry (the unambiguous default); required to pick among multiple. Ignored entirely if the caller already has an existing Vectros identity, presented an invite_token, or the issuer offers no self-signup policies at all.

      This does NOT reopen the caller-supplied-scope concern named above: signup_type never selects a privilege level, only WHICH pre-authored, already-open policy entry to bind to. Every selfSignupPolicies entry is, by construction, something you already decided ANY caller who can present a token from this issuer may have — self-service, no invite, is exactly that decision, so there is no privilege differential between entries for a caller to escalate into by naming a different one than your frontend intended. The platform independently enforces that this is actually true (no entry may ever resolve to an elevated role) regardless of what this field's value is. Because "any caller who can present a token from this issuer" is the real trust boundary, self-signup is only as narrow as your issuer's own audience — it is not a substitute for restricting who can obtain a token from your identity provider in the first place.

    • signupType

      TokenExchangeRequest._FinalStage signupType(String signupType)

    • contextId

      TokenExchangeRequest._FinalStage contextId(Optional<String> contextId)

      Selects which app context to target, for an issuer registered against more than one (each via its own POST /v1/auth/issuers row and a distinct audience). Not part of RFC 8693 — a Vectros-specific extension field, additive to the standard grant. Omit when your subject_token's aud claim matches only one registered context (the common case, and unaffected by this field's addition — behavior is unchanged from before this field existed). When your token's aud claims could match MORE than one of your registered contexts, name the one you want; a mismatch (naming a context this issuer is not registered against) is refused identically to an unrecognized issuer — the response does not distinguish the two.

    • contextId

      TokenExchangeRequest._FinalStage contextId(String contextId)