Mandatory claims

Require certain claims to be present before the user can consent.

The standard claims parameter normally lets you request “essential” claims in id_token and userinfo. Since A3BC returns the same information in both, it ignores those elements and offers a mandatory object instead.

Format

UTF-8 JSON, URL-encoded, passed in the claims parameter:

{
  "mandatory": [
    "given_name",
    "family_name",
    "email",
    "private:doc.id"
  ]
}

Rules

• A mandatory claim must also be covered by a requested scope, otherwise it is ignored.
• A mandatory claim is one that is neither null nor empty.
• The user cannot validate their consent until the mandatory information is available. If it still happens, the flow ends in an error.
• With delayed sharing, a mandatory claim must be available and validated at consent time.

import json, urllib.parse
claims = json.dumps({"mandatory": ["given_name", "family_name", "email"]})
params["claims"] = claims  # urlencode takes care of the encoding

const claims = JSON.stringify({ mandatory: ["given_name", "family_name", "email"] });
url.searchParams.set("claims", claims);