protect authorization_details against tampering and swapping..

Condition: If the integrity of authorization_details is a concern.

"clients MUST protect authorization_details against tampering and swapping."

conform to the authorization-error processing rules in Section 5..

Condition: When processing authorization_details in a token request produces an error.

"The Token Error Response MUST conform to the rules given in Section 5."

use the structure defined in Section 2, potentially filtered and extended for the requesting resource server..

Condition: When included in an introspection response.

"The authorization_details member MUST contain the same structure defined in Section 2"

use only one authorization-requirement form: authorization_details or scope..

Condition: When authorization_details and scope are supported.

"It is RECOMMENDED that a given API use only one form of requirement specification."

define fields extending the common authorization-details data fields, subject to the object's type..

"An API MAY define its own extensions, subject to the type of the respective authorization object."

contain multiple entries of the same type..

"An authorization_details array MAY contain multiple entries of the same type."

choose type values that are easily copied without ambiguity..

"It is RECOMMENDED that API designers choose type values that are easily copied without ambiguity."

use a collision-resistant namespace under their control, such as a URI they control..

Condition: If an application or API is expected to be deployed across different servers.

"the API designer is RECOMMENDED to use a collision-resistant namespace under their control"

include a type field containing a string identifier for the authorization-details type..

Condition: When an authorization_details array is used.

"This field is REQUIRED."

consider using pushed authorization requests to improve flow security, privacy, and reliability..

Condition: For authorization requests defined by RFC 6749.

"implementers MAY consider using pushed authorization requests"

differ from the authorization details requested by the client..

Condition: As permitted by the applicable authorization-details type definition.

"The authorization details attached to the access token MAY differ from what the client requests."

properly sanitize and handle authorization_details data to prevent injection attacks..

"The AS MUST properly sanitize and handle the data passed in the authorization_details in order to prevent injection attacks."

process authorization_details and scope requirements in combination..

Condition: When both parameters occur in the same authorization request.

"The AS MUST process both sets of requirements in combination with each other"

present the merged set of requirements represented by the authorization request..

Condition: When gathering user consent.

"the AS MUST present the merged set of requirements represented by the authorization request."

refuse to process unknown authorization-details types or authorization details that do not conform to their type definitions..

"The AS MUST refuse to process any unknown authorization details type or authorization details not conforming to the respective type definition."

abort processing and return invalid_authorization_details when an object has an unknown type, unknown fields, incorrectly typed or invalid field values, or missing required fields..

Condition: If any authorization_details object has one of the listed defects.

"The AS MUST abort processing and respond with an error invalid_authorization_details"

return the authorization_details granted by the resource owner and assigned to the respective access token..

Condition: In addition to the token response parameters defined by RFC 6749.

"the AS MUST also return the authorization_details as granted by the resource owner and assigned to the respective access token."

convey authorization-detail information using authorization_details as a top-level member of the introspection response JSON object..

Condition: If authorization-detail information for the token is included in an introspection response.

"the information MUST be conveyed with authorization_details as a top-level member"

omit values from the authorization_details returned to the client..

Condition: When returning a token response.

"The AS MAY omit values in the authorization_details to the client."