Include a fragment component in a `resource` URI..

Condition: When including a `resource` parameter.

[The resource URI] MUST NOT include a fragment component.

Include `actor_token_type`..

Condition: When `actor_token` is absent.

[actor_token_type] MUST NOT be included otherwise.

Provide each `resource` value as an absolute URI..

Condition: When including a `resource` parameter.

The value of the resource parameter MUST be an absolute URI.

Include the `grant_type` parameter with the value `urn:ietf:params:oauth:grant-type:token-exchange`..

Condition: When making a token exchange request.

grant_type REQUIRED. The value urn:ietf:params:oauth:grant-type:token-exchange indicates that a token exchange is being performed.

Include a `subject_token` representing the identity of the party on whose behalf the request is made..

Condition: When making a token exchange request.

subject_token REQUIRED.

Include `subject_token_type` identifying the type of the supplied subject token..

Condition: When making a token exchange request.

subject_token_type REQUIRED.

Include `actor_token_type` identifying the type of the actor token..

Condition: When `actor_token` is present.

This is REQUIRED when the actor_token parameter is present in the request.

Include a query component in a `resource` URI..

Condition: When including a `resource` parameter.

[The resource URI] MAY include a query component.

Include one or more `resource` parameters identifying target services or resources..

Condition: When the client needs to identify where it intends to use the requested token.

resource OPTIONAL.

Include one or more `audience` parameters identifying target services by logical name..

Condition: When the client needs to identify intended audiences.

audience OPTIONAL.

Include a `scope` parameter containing space-delimited, case-sensitive scope values..

Condition: When specifying the desired scope of the requested security token.

scope OPTIONAL.

Include `requested_token_type` to identify the desired type of security token..

Condition: When requesting a particular token type.

requested_token_type OPTIONAL.

Include an `actor_token` representing the identity of an acting party..

Condition: When an acting party is involved.

actor_token OPTIONAL.

Perform the appropriate validation procedures for the indicated subject token type and, when present, the indicated actor token type..

Condition: When processing a token exchange request.

The authorization server MUST perform the appropriate validation procedures for the indicated token type and, if the actor token is present, also perform the appropriate validation procedures for its indicated token type.