PageSourceSearch

https://sharedsignals.guide/

html sharedsignals.guide collected 2026-10-03 23:24:55 UTC 98,091 bytes, 315 lines download raw bytes

1<!DOCTYPE html>
2<html lang="en">
3    <head>
vendor: 72 bytes, lines 3-4
3
4        <script async src="https://www.googletagmanager.com/gtag/js?id=
4G-JTHSDS7YW8
vendor: 43 bytes, lines 4-5
4" type="text/javascript"></script>
5        
5<script src="https://fast.wistia.com/embed/medias/f8hm8bwe5w.jsonp" async></script>
5
6        
6<script src="https://fast.wistia.com/assets/external/E-v1.js" async></script>
6
7        <link rel="preconnect" href="https://fonts.googleapis.com">
8        <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
9        <link href="https://fonts.googleapis.com/css2?family=Bai+Jamjuree:wght@200&display=swap" rel="stylesheet">
10        <link rel="icon" href="/dist/images/favicon.ico">
11        <link href="/dist/css/index.css" rel="stylesheet" />
12
13        <title>Guide to Shared Signals</title>
14        
15        <meta name="viewport" content="width=device-width, initial-scale=1" />
16        <meta property="og:type" content="website">
17        <meta property="og:site_name" content="Guide to Shared Signals">
18        <meta property="og:url" content="https://sharedsignals.guide">
19        <meta name="twitter:card" content="summary_large_image">
20        <meta name="twitter:creator" content="">
21        <meta property="og:title" content="Guide to Shared Signals">
22        <meta name="twitter:title" content="Guide to Shared Signals">
23        <meta name="twitter:image" content="" >
24        <meta property="og:image" content="" >
25        <meta property="og:image:width" content="1200">
26        <meta property="og:image:height" content="630">
27        <meta name="description" content="">
28        <meta property="og:description" content="">
29        <meta name="twitter:description" content="">
30        <meta name="google-site-verification" content="2uzJEv_uBTWWU-_SCUUMorgs2ftPTSrGnWSVqAAtnbo"/>
31    </head>
32    <body>
33        <div id="main">
34            
35                <div class="container-fluid" data-reactroot=""><div class="row"><div class="sidebar fixed-top
36              d-none
37              d-md-block
38              pt-3
39              pl-lg-4 pr-lg-5
40              pl-xl-5 pr-xl-3
41             col-md-3 col-xl-2"><nav><div class="row-link my-1 selected"><a href="#intro">Shared Signals</a></div><div class="row-link my-1"><a href="#aboutssf">Shared Signals Framework</a></div><div class="row-link my-1"><a href="#definitions">Concepts and Definitions</a></div><div class="row-link my-1"><a href="#setup">Setting up a Receiver</a></div><div class="row-link my-1 pl-3"><a href="#getendpoints">Get the Stream Management Endpoints</a></div><div class="row-link my-1 pl-3"><a href="#updateconfiguration">Update the Stream Configuration</a></div><div class="row-link my-1 pl-3"><a href="#addsubject">Add a Subject</a></div><div class="row-link my-1 pl-3"><a href="#requestverification">Request a Verification Event</a></div><div class="row-link my-1 pl-3"><a href="#pollevents">Poll for Events</a></div><div class="row-link my-1"><a href="#lookingforward">Looking Forward</a></div><div class="row-link my-1"><a href="#eventdefinitions">Event Type Definitions</a></div><div class="row-link my-1 pl-3"><a href="#caepevents">CAEP Events</a></div><div class="row-link my-1 pl-3"><a href="#riscevents">RISC Events</a></div></nav></div><div class="col"><main><div class="introduction row"><div class="contentCol col"><div><div id="intro" class="section"><div class="row"><div class="header col"><div class="headertext"><h1>Shared Signals</h1><div class="lead">To make Zero Trust work, we have to talk to each other.</div></div></div></div><div class="row"><div class="col-lg-9"><h2>There are thousands of brilliant vendors in the security space.</h2><p class="lead">But the siloed nature of security stacks is inhibiting the adoption of Zero Trust.</p><p>IT and Security professionals have more choice than ever in how to secure their environments. At the same time, complexity in integration and communication has exploded. Security vendors, even if they solve a particular problem flawlessly, often can&#x27;t communicate their information effectively to other parts of the IT environment. This lack of communication limits value, increases security risk, and encumbers the adoption of<!-- --> <a rel="noopener" href="https://duo.com/solutions/zero-trust-security" target="_blank">Zero Trust</a>. If an endpoint detection solution notices a problem with a user&#x27;s device but can&#x27;t easily share that information with the control plane, how can it stop the problem from spreading?</p></div></div></div><div class="section"><div class="row"><div class="col-lg-9"><h2>Real-time communication between security solutions should be easy.</h2><p class="lead">A standardized approach is required to simplify communication.</p><p>Traditionally, if vendors grant access to their security signals at all, they do it via a solution-specific API. To consume signals from multiple security vendors, IT professionals must wire up custom connections with each one. It&#x27;s as if some vendors deliver their information in freight cars, others in container ships, and others by plane. This means organizations need to build a train station, a shipyard, and an airport! A standardized transport specification across security solutions makes it easy to incorporate new signals.</p><p>By building to an open standard, we can simply, consistently, and scalably share events, making security easier and more robust for our customers.</p><p>It&#x27;s time to share signals.</p></div></div></div></div></div></div><div class="row"><div class="contentCol col"><div id="aboutssf" class="section"><div class="row"><div class="col-lg-9"><h2>Shared Signals Framework</h2><p>The<!-- --> <a rel="noopener" href="https://openid.net/specs/openid-sharedsignals-framework-1_0-ID3.html" target="_blank">Shared Signals Framework (SSF)</a> <!-- -->is a new standard from the OpenID Foundation. Its purpose is to make it easy for c
41ompanies to share security events related to the users who are using their systems. As stated on the<!-- --> <a rel="noopener" href="https://openid.net/wg/sse/" target="_blank">working group&#x27;s page</a>:</p><blockquote><p>The goal of the SSF Working Group is to enable the sharing of security events, state changes, and other signals between related and/or dependent systems in order to:</p><ol><li>Manage access to resources and enforce access control restrictions across distributed services operating in a dynamic environment.</li><li>Prevent malicious actors from leveraging compromises of accounts, devices, services, endpoints, or other principals or resources to gain unauthorized access to additional systems or resources.</li><li>Enable users, administrators, and service providers to coordinate in order to detect and respond to incidents.</li></ol></blockquote></div></div><div class="wistia_responsive_padding" style="margin:100px 0 0 0;padding:56.25% 0 0 0;position:relative"><div class="wistia_responsive_wrapper" style="height:100%;left:0;position:absolute;top:0;width:100%"><div class="wistia_embed wistia_async_f8hm8bwe5w videoFoam=true" style="height:100%;position:relative;width:100%"><div class="wistia_swatch" style="height:100%;left:0;opacity:0;overflow:hidden;position:absolute;top:0;transition:opacticy 200ms;width:100%"><img src="https://fast.wistia.com/embed/medias/f8hm8bwe5w/swatch" style="height:100%;filter:blur(5px);object-fit:contain;width:100%" alt="Video describing why we need SSF" aria-hidden="true"/></div></div></div></div></div></div></div><div class="blue-bg mb-5 row"><div class="contentCol col"><div id="definitions" class="section"><div class="row"><div class="col-lg-12"><h2>Concepts and Definitions</h2><p class="lead">The Shared Signals Framework relies on five primary concepts:</p></div></div><div class="justify-centered pr-md-3 pr-lg-0 mx-0 row"><div class="px-2 px-md-3 col-md-6 col-lg-4"><img src="/dist/images/subject.svg" alt="a graph showing different types of subjects: a user, a group, an organization, and a device" class="definition-image"/><h3>Subject</h3><p>A person, device, group, or organization about whom we want to communicate security events. The format of a Subject is described<!-- --> <a rel="noopener" href="https://github.com/duo-labs/sharedsignals/blob/main/docs/subjects-in-ssf.md" target="_blank">in this open source documentation.</a></p></div><div class="p-2 px-md-3 col-md-6 col-lg-4"><img src="/dist/images/token.svg" alt="a sheet of paper, with the message &quot;security event&quot; scribbled on it" class="definition-image"/><h3>Event</h3><p>A security-related occurrence pertaining to a subject. Examples of events are when a user&#x27;s session is revoked or their device goes out of compliance. These events are sent between parties as Security Event Tokens (SET) which are a type of JSON Web Token (JWT).</p></div><div class="p-2 px-md-3 col-md-6 col-lg-4"><img src="/dist/images/transmitter.svg" alt="a person throwing a paper airplane, representing an event transmitter" class="definition-image"/><h3>Transmitter</h3><p>A transmitter is a vendor that is broadcasting events to other vendors. In order to be a transmitter, you must define a set of API endpoints that fulfills the stream management spec described<!-- --> <a rel="noopener" href="https://github.com/duo-labs/sharedsignals/blob/main/transmitter_spec/openapi.yaml" target="_blank">by this OpenAPI specification.</a>.</p></div><div class="p-2 px-md-3 col-md-6 col-lg-4"><img src="/dist/images/receiver.svg" alt="a person who just caught a paper airplaine, representing an event receiver" class="definition-image"/><h3>Receiver</h3><p>A receiver is a security vendor that receives and acts on events. Receivers can configure what subjects they are interested in and how they would like to receive events by using the Stream Management API provided by a transmitter.</p></div><div class="p-2 px-md-3 col-md-6 col-lg-4"><img src="/dist/images/stream.svg" alt="two paper airplanes in flight, representing events passing between transmitter and receiver" class="definition-image"/><h3>Stream</h3><p>A stream is an abstraction for how events flow from a transmitter to a receiver. There can be a single stream between a transmitter and receiver, or there can be multiple streams. The transmitter advertises whether it supports PUSHing events to the receiver or being POLLed for events, or both. The receiver can choose which of the supported methods it prefers for communication.</p></div></div></div></div></div><div class="row"><div class="contentCol col"><div id="setup" class="section"><div class="row"><div class="col-lg-9"><h2>Setting Up a Receiver</h2></div></div><div class="row"><div class="col-lg-9"><p class="warning">Please note: The information shown here reflects<!-- --> <a rel="noopener" href="https://openid.net/specs/openid-sharedsignals-framework-1_0-ID3.htm" target="_blank">implementer’s draft 3.</a><br/>When the Shared Signals Framework specification reaches a release 1.0, we will update this guide.</p></div></div><div class="no-gutter row"><div class="col-md-12 col-lg-6"><p>
41In the following sections we will walk you through how to configure an Event Receiver. You can run any of the following code snippets against a locally running version of our<!-- --> <a rel="noopener" href="https://github.com/duo-labs/sharedsignals/blob/main/examples/transmitter/README.md" target="_blank">example Event Transmitter</a>.</p><p>Imagine you&#x27;re a developer at PopularApp, a SaaS company that cares about the security of its users. You&#x27;ve learned that MostSecure, a well-established security company that monitors the web for breaches and password dumps, has set up an Event Transmitter that can share security signals about PopularApp users. In order to consume these signals and protect your users, you&#x27;ll need to set up an Event Receiver.</p><p>As an event receiver, PopularApp will request a list of stream management endpoints from the transmitter, MostSecure. It will then use those endpoints to tell MostSecure what kinds of events it is interested in, how it wants to receive them, and which subjects it cares about. Finally, PopularApp can ask for a verification event to ensure the stream is configured correctly.</p></div><div class="col-11 mx-auto col-sm-8 col-md-10 col-lg-6 col"><div title="Example conversation between PopularApp and MostSecure"><div aria-label="PopularApp says:" class="avatar user-avatar row"><div class="avatar-image col-auto col-sm-auto col-md-auto col-lg-auto col-xl-auto"><img role="presentation" alt="" src="/dist/images/popularapp.svg"/></div><div class="arrow-box arrow-box-left p-2
42                   col"><div class="p-0 m-0 conversation content"><span>Hey, I heard you broadcast security events!</span></div></div><div class="col-1 col-sm-1 col-md-2 col-lg-1 col-xl-2"></div></div><div aria-label="PopularApp says:" class="avatar server-avatar row"><div class="col-1 col-sm-1 col-md-2 col-lg-1 col-xl-2"></div><div class="arrow-box arrow-box-right p-2
43                     col"><div class="p-0 m-0 conversation content"><span>I sure do! Here&#x27;s all the info you&#x27;ll need to manage a stream.</span></div></div><div class="avatar-image col-auto col-sm-auto col-md-auto col-lg-auto col-xl-auto"><img role="presentation" alt="" src="/dist/images/mostsecure.svg"/></div></div><div aria-label="PopularApp says:" class="avatar user-avatar row"><div class="avatar-image col-auto col-sm-auto col-md-auto col-lg-auto col-xl-auto"><img role="presentation" alt="" src="/dist/images/popularapp.svg"/></div><div class="arrow-box arrow-box-left p-2
44                   col"><div class="p-0 m-0 conversation content"><span>Excellent. Sign me up for Device Compliance Change events. I&#x27;d like to poll for them.</span></div></div><div class="col-1 col-sm-1 col-md-2 col-lg-1 col-xl-2"></div></div><div aria-label="PopularApp says:" class="avatar server-avatar row"><div class="col-1 col-sm-1 col-md-2 col-lg-1 col-xl-2"></div><div class="arrow-box arrow-box-right p-2
45                     col"><div class="p-0 m-0 conversation content"><span>Done. Here&#x27;s the URL you&#x27;ll use for polling.</span></div></div><div class="avatar-image col-auto col-sm-auto col-md-auto col-lg-auto col-xl-auto"><img role="presentation" alt="" src="/dist/images/mostsecure.svg"/></div></div><div aria-label="PopularApp says:" class="avatar user-avatar row"><div class="avatar-image col-auto col-sm-auto col-md-auto col-lg-auto col-xl-auto"><img role="presentation" alt="" src="/dist/images/popularapp.svg"/></div><div class="arrow-box arrow-box-left p-2
46                   col"><div class="p-0 m-0 conversation content"><span>Can I subscribe to events for Reginold Jones?</span></div></div><div class="col-1 col-sm-1 col-md-2 col-lg-1 col-xl-2"></div></div><div aria-label="PopularApp says:" class="avatar server-avatar row"><div class="col-1 col-sm-1 col-md-2 col-lg-1 col-xl-2"></div><div class="arrow-box arrow-box-right p-2
47                     col"><div class="p-0 m-0 conversation content"><span>Okie dokie.</span></div></div><div class="avatar-image col-auto col-sm-auto col-md-auto col-lg-auto col-xl-auto"><img role="presentation" alt="" src="/dist/images/mostsecure.svg"/></div></div><div aria-label="PopularApp says:" class="avatar user-avatar row"><div class="avatar-image col-auto col-sm-auto col-md-auto col-lg-auto col-xl-auto"><img role="presentation" alt="" src="/dist/images/popularapp.svg"/></div><div class="arrow-box arrow-box-left p-2
48                   col"><div class="p-0 m-0 conversation content"><span>Can you queue up a verification event so that I can be sure it&#x27;s all working?</span></div></div><div class="col-1 col-sm-1 col-md-2 col-lg-1 col-xl-2"></div></div><div aria-label="PopularApp says:" class="avatar server-avatar row"><div class="col-1 col-sm-1 col-md-2 col-lg-1 col-xl-2"></div><div class="arrow-box arrow-box-right p-2
49                     col"><div class="p-0 m-0 conversation content"><span>Sure! If you poll for events, I&#x27;ll have one waiting for you in no time.</span></div></div><div class="avatar-image col-auto col-sm-auto col-md-auto col-lg-auto col-xl-auto"><img role="presentation" alt="" src="/dist/images/mostsecure.svg"/></div></div></div></div></div></div><div class="section" id="getendpoints"><div class="row"><div class="col-lg-9"><h3>Get the Stream Management Endpoints</h3><p>The first thing PopularApp&#x27;s receiver needs to do is to discover the endpoints it can use to manage the event stream hosted by MostSecure.</p><p>The receiver makes an HTTPS GET request to the transmitter&#x27;s SSF configuration endpoint.</p></div></div><div class="syntax-highlighter-row row"><div class="col-lg-12"><pre class="language-python"><code><span class="shadowed"><span class="token comment"># In this and the following example python snippets, we&#x27;re using the</span><span class="">
50</span></span><span class="shadowed"><span class=""></span><span class="token comment"># requests library to issue basic HTTPS requests to an example Event</span><span class="">
51</span></span><span class="shadowed"><span class=""></span><span class="token comment"># Transmitter. Note that for this ssf-configuration request, no</span><span class="">
52</span></span><span class="shadowed"><span class=""></span><span class="token comment"># authorization is needed.</span><span class="">
53</span></span><span class=""><span class="">ssf_config_response </span><span class="token operator">=</span><span class=""> requests</span><span class="token punctuation">.</span><span class="">
53get</span><span class="token punctuation">(</span><span class="">
54</span></span><span class=""><span class="">  </span><span class="token string">&quot;https://transmitter.most-secure.com/.well-known/ssf-configuration&quot;</span><span class="">
55</span></span><span class=""><span class=""></span><span class="token punctuation">)</span><span class="">
56</span></span><span class=""><span class="">ssf_config </span><span class="token operator">=</span><span class=""> ssf_config_response</span><span class="token punctuation">.</span><span class="">json</span><span class="token punctuation">(</span><span class="token punctuation">)</span></span></code></pre></div></div><div class="row"><div class="col-lg-9"><a id="ssf_config_response"></a><p>In the response, the receiver will find all of the various endpoints needed to configure their stream. We will describe how these endpoints get used in the sections below.</p></div></div><div class="syntax-highlighter-row row"><div class="col-lg-12"><pre class="language-json"><code><span class=""><span class="token punctuation">{</span><span class="">
57</span></span><span class="shadowed">  # This endpoint will be used by the receiver to view or update
58</span><span class="shadowed">  # the configuration of their stream.
59</span><span class=""><span class="">  </span><span class="token property">&quot;configuration_endpoint&quot;</span><span class="token operator">:</span><span class=""> </span><span class="token string">&quot;https://transmitter.most-secure.com/stream&quot;</span><span class="token punctuation">,</span><span class="">
60</span></span><span class="shadowed">  # This endpoint will be used by the receiver to add subjects to their stream.
61</span><span class=""><span class="">  </span><span class="token property">&quot;add_subject_endpoint&quot;</span><span class="token operator">:</span><span class=""> </span><span class="token string">&quot;https://transmitter.most-secure.com/add-subject&quot;</span><span class="token punctuation">,</span><span class="">
62</span></span><span class="shadowed">  # This endpoint will be used by the receiver to remove subjects from their stream.
63</span><span class=""><span class="">  </span><span class="token property">&quot;remove_subject_endpoint&quot;</span><span class="token operator">:</span><span class=""> </span><span class="token string">&quot;https://transmitter.most-secure.com/remove-subject&quot;</span><span class="token punctuation">,</span><span class="">
64</span></span><span class="shadowed"><span class="">  # This endpoint will be used by the receiver to request a verification event</span><span class="token punctuation">,</span><span class="">
65</span></span><span class="shadowed">  # so that the receiver can have confidence that the stream is working as intended.
66</span><span class=""><span class="">  </span><span class="token property">&quot;verification_endpoint&quot;</span><span class="token operator">:</span><span class=""> </span><span class="token string">&quot;https://transmitter.most-secure.com/verification&quot;</span><span class="token punctuation">,</span><span class="">
67</span></span><span class="shadowed">  # This endpoint will be used by the receiver to get or set the
68</span><span class="shadowed"><span class="">  # status for the stream as a whole</span><span class="token punctuation">,</span><span class=""> or for individual subjects on the stream.
69</span></span><span class=""><span class="">  </span><span class="token property">&quot;status_endpoint&quot;</span><span class="token operator">:</span><span class=""> </span><span class="token string">&quot;https://transmitter.most-secure.com/status&quot;</span><span class="token punctuation">,</span><span class="">
70</span></span><span class="shadowed"><span class="">  # This is the URL identifier of the transmitter</span><span class="token punctuation">;</span><span class=""> it matches the iss claim
71</span></span><span class="shadowed">  # in all events issued by this transmitter.
72</span><span class=""><span class="">  </span><span class="token property">&quot;issuer&quot;</span><span class="token operator">:</span><span class=""> </span><span class="token string">&quot;https://most-secure.com/&quot;</span><span class="token punctuation">,</span><span class="">
73</span></span><span class="shadowed">  # This is the URL of the transmitter&#x27;s JSON Web Key Set. You can use
74</span><span class="shadowed">  # this to validate and decode the events sent by the transmitter.
75</span><span class=""><span class="">  </span><span class="token property">&quot;jwks_uri&quot;</span><span class="token operator">:</span><span class=""> </span><span class="token string">&quot;https://transmitter.most-secure.com/jwks.json&quot;</span><span class="token punctuation">,</span><span class="">
76</span></span><span class="shadowed">  # This attribute lets the transmitter declare which means of event
77</span><span class="shadowed"><span class="">  # delivery it supports</span><span class="token operator">:</span><span class=""> pushing</span><span class="token punctuation">,</span><span class=""> polling</span><span class="token punctuation">,</span><span class=""> or both.
78</span></span><span class=""><span class="">  </span><span class="token property">&quot;delivery_methods_supported&quot;</span><span class="token operator">:</span><span class=""> </span><span class="token punctuation">[</span><span class="">
79</span></span><span class=""><span class="">    </span><span class="token string">&quot;https://schemas.openid.net/secevent/risc/delivery-method/push&quot;</span><span class="token punctuation">,</span><span class="">
80</span></span><span class=""><span class="">    </span><span class="token string">&quot;https://schemas.openid.net/secevent/risc/delivery-method/poll&quot;</span><span class="">
81</span></span><span class=""><span class="">  </span><span class="token punctuation">]</span><span class="token punctuation">,</span><span class="">
82</span></span><span class="shadowed">  # This attribute comes into play when Complex Subjects are used.
83</span><span class="shadowed"><span class="">  # A critical member is one that</span><span class="token punctuation">,</span><span class=""> if present</span><span class="token punctuation">,</span><span class=""> must be interpreted by the receiver.
84</span></span><span class=""><span class="">  </span><span class="token property">&quot;critical_subject_members&quot;</span><span class="token operator">:</span><span class=""> </span><span class="token punctuation">[</span><span class="">
85</span></span><span class=""><span class="">    </span><span class="token string">&quot;user&quot;</span><span class="">
86</span></span><span class=""><span class="">  </span><span class="token punctuation">]</span><span class="token punctuation">,</span><span class="">
87</span></span><span class="shadowed">  # This attribute lets the Receiver know which version of the spec the
88</span><span class="shadowed">  # Transmitter is supporting.
89</span><span class=""><span class="">  </span><span class="token property">&quot;spec_version&quot;</span><span class="token operator">:</span><span class=""> </span><span class="token string">&quot;1_0-ID3&quot;</span><span class="token punctuation">,</span><span class="">
90</span></span><span class="shadowed">  # This field indicates what types of authorization the Transmitter accepts.
91</span><span class="shadowed"><span class="">  # In this case</span><span class="token punctuation">,</span><span class="">
91 we are indicating the OAuth protocol.
92</span></span><span class=""><span class="">  </span><span class="token property">&quot;authorization_schemes&quot;</span><span class="token operator">:</span><span class=""> </span><span class="token punctuation">[</span><span class="">
93</span></span><span class=""><span class="">    </span><span class="token punctuation">{</span><span class="token property">&quot;spec_urn&quot;</span><span class="token operator">:</span><span class=""> </span><span class="token string">&quot;urn:ietf:rfc:6749&quot;</span><span class="token punctuation">}</span><span class="">
94</span></span><span class=""><span class="">  </span><span class="token punctuation">]</span><span class="token punctuation">,</span><span class="">
95</span></span><span class="shadowed">  # This attribute indicates whether subjects need to be explicitly added to
96</span><span class="shadowed">  # the stream or not. The possible values are ‘ALL’ meaning that all subjects
97</span><span class="shadowed"><span class="">  # are implicitly added to the stream at creation time</span><span class="token punctuation">,</span><span class=""> or ‘NONE’ meaning that
98</span></span><span class="shadowed">  # each subject of interest must be added explicitly by the Receiver.
99</span><span class=""><span class="">  </span><span class="token property">&quot;default_subjects&quot;</span><span class="token operator">:</span><span class=""> </span><span class="token string">&quot;NONE&quot;</span><span class="">
100</span></span><span class=""><span class=""></span><span class="token punctuation">}</span></span></code></pre></div></div></div><div class="section" id="updateconfiguration"><div class="row"><div class="col-lg-9"><h3>Create a Stream</h3><p>Next, the receiver can use the configuration endpoint to create, read, update, or delete the configuration of its stream. Note that most pieces of stream configuration are read-only – that is, they are either set by the transmitter, or set out-of-band from these endpoints.</p><p>To create the stream, the receiver makes an HTTP POST request to the configuration endpoint. Let&#x27;s set the &quot;delivery&quot;, &quot;events_requested&quot;, and &quot;description&quot; arguments.</p><p>Since PopularApp is relying on MostSecure to find out if their users&#x27; passwords were leaked, it will request the<!-- --> <a href="#risc_credential_compromised">RISC Credential Compromise</a> <!-- -->event.</p></div></div><div class="syntax-highlighter-row row"><div class="col-lg-12"><pre class="language-python"><code><span class=""><span class="">stream_config_response </span><span class="token operator">=</span><span class=""> requests</span><span class="token punctuation">.</span><span class="">post</span><span class="token punctuation">(</span><span class="">
101</span></span><span class="shadowed"><span class="">  </span><span class="token comment"># Note that this request posts to the configuration_endpoint of the ssf_config</span><span class="">
102</span></span><span class="shadowed"><span class="">  </span><span class="token comment"># returned in the last example.</span><span class="">
103</span></span><span class=""><span class="">  url</span><span class="token operator">=</span><span class="">ssf_config</span><span class="token punctuation">[</span><span class="token string">&quot;configuration_endpoint&quot;</span><span class="token punctuation">]</span><span class="token punctuation">,</span><span class="">
104</span></span><span class=""><span class="">  json</span><span class="token operator">=</span><span class="token punctuation">{</span><span class="">
105</span></span><span class="shadowed"><span class="">    </span><span class="token comment"># The receiver specifies how it would like to receive events, polling or pushing.</span><span class="">
106</span></span><span class=""><span class="">    </span><span class="token string">&quot;delivery&quot;</span><span class="token punctuation">:</span><span class=""> </span><span class="token punctuation">{</span><span class="">
107</span></span><span class="shadowed"><span class="">      </span><span class="token comment">
107# We are choosing the Polling method.</span><span class="">
108</span></span><span class=""><span class="">      </span><span class="token string">&quot;method&quot;</span><span class="token punctuation">:</span><span class=""> </span><span class="token string">&quot;urn:ietf:rfc:8936&quot;</span><span class="token punctuation">,</span><span class="">
109</span></span><span class="shadowed"><span class="">      </span><span class="token comment"># In this example, because we&#x27;re choosing Polling as our delivery method,</span><span class="">
110</span></span><span class="shadowed"><span class="">      </span><span class="token comment"># we can leave delivery.endpoint_url blank, as it is the Transmitter&#x27;s</span><span class="">
111</span></span><span class="shadowed"><span class="">      </span><span class="token comment"># responsibility to specify that. If we had chosen Push, we would use this</span><span class="">
112</span></span><span class="shadowed"><span class="">      </span><span class="token comment"># value to tell the Transmitter where to send the events.</span><span class="">
113</span></span><span class=""><span class="">      </span><span class="token string">&quot;endpoint_url&quot;</span><span class="token punctuation">:</span><span class=""> </span><span class="token boolean">None</span><span class="">
114</span></span><span class=""><span class="">    </span><span class="token punctuation">}</span><span class="token punctuation">,</span><span class="">
115</span></span><span class="shadowed"><span class="">    </span><span class="token comment"># The receiver tells the transmitter what types of events it is interested in</span><span class="">
116</span></span><span class="shadowed"><span class="">    </span><span class="token comment"># getting on this stream by listing the URIs of the event types. The full list</span><span class="">
117</span></span><span class="shadowed"><span class="">    </span><span class="token comment"># of CAEP and RISC events are detailed in the Events section below, however the</span><span class="">
118</span></span><span class="shadowed"><span class="">    </span><span class="token comment"># SSF standard is general enough to cover any kind of event type. In our</span><span class="">
119</span></span><span class="shadowed"><span class="">    </span><span class="token comment"># imaginary scenario, PopularApp only cares about the Credential Compromise event.</span><span class="">
120</span></span><span class=""><span class="">    </span><span class="token string">&quot;events_requested&quot;</span><span class="token punctuation">:</span><span class=""> </span><span class="token punctuation">[</span><span class="">
121</span></span><span class=""><span class="">      </span><span class="token string">&quot;https://schemas.openid.net/secevent/risc/event-type/credential-compromise&quot;</span><span class="token punctuation">,</span><span class="">
122</span></span><span class=""><span class="">    </span><span class="token punctuation">]</span><span class="">
123</span></span><span class="shadowed"><span class="">    </span><span class="token comment"># Use this optional field to give a human-readable label to the stream</span><span class="">
124</span></span><span class="shadowed"><span class="">    </span><span class="token comment"># for easier debugging.</span><span class="">
125</span></span><span class=""><span class="">    </span><span class="token string">&quot;description&quot;</span><span class="token punctuation">:</span><span class=""> </span><span class="token string">&quot;A stream between PopularApp and MostSecure&quot;</span><span class="">
126</span></span><span class=""><span class="">  </span><span class="token punctuation">}</span><span class="token punctuation">,</span><span class="">
127</span></span><span class="shadowed"><span class="">  </span><span class="token comment"># For this and all remaining requests, we need to include an Authorization header</span><span class="">
128</span></span><span class="shadowed"><span class="">  </span><span class="token comment"># with a Bearer token that the transmitter will be able to use to uniquely identify</span><span class="">
129</span></span><span class="shadowed"><span class="">  </span><span class="token comment"># us as a receiver.</span><span class="">
130</span></span><span class="shadowed"><span class="">  </span><span class="token comment"># These examples use a &quot;secret&quot; that our transmitter maps to PopularApp.</span><span class="">
131</span></span><span class="shadowed"><span class="">  </span><span class="token comment"># In practice, this secret would be generated by an OAuth Client Credentials Grant</span><span class="">
132</span></span><span class="shadowed"><span class="">  </span><span class="token comment"># flow or some other secure method of transmitting a secret between parties.</span><span class="">
133</span></span><span class=""><span class="">  headers</span><span class="token operator">=</span><span class="token punctuation">{</span><span class="">
134</span></span><span class=""><span class="">    </span><span class="token string">&quot;Authorization&quot;</span><span class="token punctuation">:</span><span class=""> </span><span class="token string">&quot;Bearer 49e5e7785e4e4f688aa49e2585970370&quot;</span><span class="token punctuation">,</span><span class="">
135</span></span><span class=""><span class="">  </span><span class="token punctuation">}</span><span class="">
136</span></span><span class=""><span class=""></span><span class="token punctuation">)</span><span class="">
137</span></span><span class=""><span class="">stream_config </span><span class="token operator">=</span><span class=""> stream_config_response</span><span class="token punctuation">.</span><span class="">json</span><span class="token punctuation">(</span><span class="token punctuation">)</span></span></code></pre></div></div><div class="row"><div class="col-lg-9"><p>The Transmitter will respond with a 201 OK response. The JSON in the response will show the new stream&#x27;s configuration.</p></div></div><div class="syntax-highlighter-row row"><div class="col-lg-12"><pre class="language-json"><code><span class=""><span class="token punctuation">{</span><span class="">
138</span></span><span class="shadowed">  # Read-Only. This value uniquely identifies the stream.
139</span><span class=""><span class="">  </span><span class="token property">&quot;stream_id&quot;</span><span class="token operator">:</span><span class=""> </span><span class="token string">&quot;e5d230dc-0ebe-455a-b22c-54b29f4d6f64&quot;</span><span class="token punctuation">,</span><span class="">
140</span></span><span class="shadowed">  # Read-Only. This URI is the issuer claim identifying the transmitter.
141</span><span class="shadowed">  # It will be included in all events set on this stream. The receiver can
142</span><span class="shadowed">  # check this value to ensure that the event was sent by the expected party.
143</span><span class=""><span class="">  </span><span class="token property">&quot;iss&quot;</span><span class="token operator">:</span><span class=""> </span><span class="token string">&quot;https://most-secure.com/&quot;</span><span class="token punctuation">,</span><span class="">
144</span></span><span class="shadowed">  # Read-Only. This string or list of strings is the audience claim identifying
145</span><span class="shadowed">  # the receiver. It will be included in all events sent on this stream.
146</span><span class="shadowed">  # The receiver can check this value to ensure the event is meant for them.
147</span><span class="shadowed">  # Either the Transmitter and Receiver have decided on an aud value to use
148</span><span class="shadowed"><span class="">  # out-of-band</span><span class="token punctuation">,</span><span class=""> or the Transmitter generates a unique value to use.
149</span></span><span class=""><span class="">  </span><span class="token property">&quot;aud&quot;</span><span class="token operator">:</span><span class=""> </span><span class="token string">&quot;a7447d1d-9a0c-4e4e-b1bb-265dab64fa8&quot;</span><span class="token punctuation">,</span><span class="">
150</span></span><span class="shadowed">  # Read-Write. This indicates how events will be shared. If the push delivery
151</span><span class="shadowed"><span class="">  # method is configured</span><span class="token punctuation">,</span><span class=""> the URL specified is where the receiver wants the
152</span></span><span class="shadowed"><span class="">  # transmitter to push events. If the polling delivery method is configured</span><span class="token punctuation">,</span><span class="">
153</span></span><span class="shadowed">  # the URL specified is the transmitter endpoint where the receiver can poll
154</span><span class="shadowed">  # for events.
155</span><span class=""><span class="">  </span><span class="token property">&quot;delivery&quot;</span><span class="token operator">:</span><span class=""> </span><span class="token punctuation">{</span><span class="">
156</span></span><span class=""><span class="">    </span><span class="token property">&quot;endpoint_url&quot;</span><span class="token operator">:</span><span class=""> </span><span class="token string">&quot;https://transmitter.most-secure.com/poll&quot;</span><span class="token punctuation">,</span><span class="">
157</span></span><span class=""><span class="">    </span><span class="token property">&quot;method&quot;</span><span class="token operator">:</span><span class=""> </span><span class="token string">&quot;urn:ietf:rfc:8936&quot;</span><span class="">
158</span></span><span class=""><span class="">  </span><span class="token punctuation">}</span><span class="token punctuation">,</span><span class="">
159</span></span><span class="shadowed">  # Read-Only. These are the event types the transmitter supports.
160</span><span class=""><span class="">  </span><span class="token property">&quot;events_supported&quot;</span><span class="token operator">:</span><span class=""> </span><span class="token punctuation">[</span><span class="">
161</span></span><span class=""><span class="">    </span><span class="token string">&quot;https://schemas.openid.net/secevent/caep/event-type/session-revoked&quot;</span><span class="token punctuation">,</span><span class="">
162</span></span><span class=""><span class="">    </span><span class="token string">&quot;https://schemas.openid.net/secevent/risc/event-type/credential-compromise&quot;</span><span class="token punctuation">,</span><span class="">
163</span></span><span class=""><span class="">  </span><span class="token punctuation">]</span><span class="token punctuation">,</span><span class="">
164</span></span><span class="shadowed">  # Read-Write. These are the event types that the receiver is interested in.
165</span><span class=""><span class="">  </span><span class="token property">&quot;events_requested&quot;</span><span class="token operator">:</span><span class=""> </span><span class="token punctuation">[</span><span class="">
166</span></span><span class=""><span class="">    </span><span class="token string">&quot;https://schemas.openid.net/secevent/risc/event-type/credential-compromise&quot;</span><span class="">
167</span></span><span class=""><span class="">  </span><span class="token punctuation">]</span><span class="token punctuation">,</span><span class="">
168</span></span><span class="shadowed">  # Read-Only. The intersection of events_requested and events_supported.
169</span><span class=""><span class="">  </span><span class="token property">&quot;events_delivered&quot;</span><span class="token operator">:</span><span class=""> </span><span class="token punctuation">[</span><span class="">
170</span></span><span class=""><span class="">    </span><span class="token string">&quot;https://schemas.openid.net/secevent/risc/event-type/credential-compromise&quot;</span><span class="">
171</span></span><span class=""><span class="">  </span><span class="token punctuation">]</span><span class="token punctuation">,</span><span class="">
172</span></span><span class="shadowed"><span class="">  # Read-Only. This is the minimum time</span><span class="token punctuation">,</span><span class=""> in seconds</span><span class="token punctuation">,</span><span class=""> that a receiver must wait
173</span></span><span class="shadowed">  # in between verification requests.
174</span><span class=""><span class="">  </span><span class="token property">&quot;min_verification_interval&quot;</span><span class="token operator">:</span><span class=""> </span><span class="token number">60</span><span class="token punctuation">,</span><span class="">
175</span></span><span class="shadowed">  # Read-Write. A human-readable label for the stream.
176</span><span class=""><span class="">  </span><span class="token property">&quot;description&quot;</span><span class="token operator">:</span><span class=""> </span><span class="token string">&quot;A stream between PopularApp and MostSecure&quot;</span><span class="">
177</span></span><span class=""><span class=""></span><span class="token punctuation">}</span></span></code></pre></div></div></div><div class="section" id="addsubject"><div class="row"><div class="col-lg-9"><h3>Add a Subject</h3><p>With the stream configured, the receiver can now tell the transmitter which subjects it is interested in. For a closer look at how subjects work, see our guide on<!-- -->
177 <a rel="noopener" href="https://github.com/duo-labs/sharedsignals/blob/main/docs/subjects-in-ssf.md" target="_blank">subjects in the Shared Signals Framework</a>.</p><p>For our example, we&#x27;ll just focus on a Simple Subject identifying a user by email address.</p></div></div><div class="syntax-highlighter-row row"><div class="col-lg-12"><pre class="language-json"><code><span class=""><span class="token punctuation">{</span><span class="">
178</span></span><span class=""><span class="">  </span><span class="token property">&quot;format&quot;</span><span class="token operator">:</span><span class=""> </span><span class="token string">&quot;email&quot;</span><span class="token punctuation">,</span><span class="">
179</span></span><span class=""><span class="">  </span><span class="token property">&quot;email&quot;</span><span class="token operator">:</span><span class=""> </span><span class="token string">&quot;[email protected]&quot;</span><span class="">
180</span></span><span class=""><span class=""></span><span class="token punctuation">}</span></span></code></pre></div></div><div class="row"><div class="col-lg-9"><p>Let&#x27;s add one of PopularApp&#x27;s users, Reginold Jones, to the event stream. To add a subject, the receiver makes an HTTPS POST request to the add subject endpoint.</p></div></div><div class="syntax-highlighter-row row"><div class="col-lg-12"><pre class="language-python"><code><span class=""><span class="">add_subject_response </span><span class="token operator">=</span><span class=""> requests</span><span class="token punctuation">.</span><span class="">post</span><span class="token punctuation">(</span><span class="">
181</span></span><span class="shadowed"><span class="">  </span><span class="token comment"># Note that this request posts to the add_subject_endpoint of</span><span class="">
182</span></span><span class="shadowed"><span class="">  </span><span class="token comment"># the ssf_config returned in the first example</span><span class="">
183</span></span><span class=""><span class="">  url</span><span class="token operator">=</span><span class="">ssf_config</span><span class="token punctuation">[</span><span class="token string">&quot;add_subject_endpoint&quot;</span><span class="token punctuation">]</span><span class="token punctuation">,</span><span class="">
184</span></span><span class=""><span class="">  json</span><span class="token operator">=</span><span class="token punctuation">{</span><span class="">
185</span></span><span class="shadowed"><span class="">    </span><span class="token comment"># Indicate which stream we are adding the subject to.</span><span class="">
186</span></span><span class=""><span class="">    </span><span class="token string">&quot;stream_id&quot;</span><span class="token punctuation">:</span><span class=""> </span><span class="token string">&quot;e5d230dc-0ebe-455a-b22c-54b29f4d6f6&quot;</span><span class="token punctuation">,</span><span class="">
187</span></span><span class="shadowed"><span class="">    </span><span class="token comment"># There are many different types of subject identifiers, but for this example we’ll</span><span class="">
188</span></span><span class="shadowed"><span class="">    </span><span class="token comment"># use the email format to identify a user by their email address.</span><span class="">
189</span></span><span class=""><span class="">    </span><span class="token string">&quot;subject&quot;</span><span class="token punctuation">:</span><span class=""> </span><span class="token punctuation">{</span><span class="">
190</span></span><span class=""><span class="">      </span><span class="token string">&quot;format&quot;</span><span class="token punctuation">:</span><span class=""> </span><span class="token string">&quot;email&quot;</span><span class="token punctuation">,</span><span class="">
191</span></span><span class=""><span class="">      </span><span class="token string">&quot;email&quot;</span><span class="token punctuation">:</span><span class=""> </span><span class="token string">&quot;[email protected]&quot;</span><span class="">
192</span></span><span class=""><span class="">    </span><span class="token punctuation">}</span><span class="">
193</span></span><span class=""><span class="">  </span><span class="token punctuation">}</span><span class="token punctuation">,</span><span class="">
194</span></span><span class=""><span class="">  headers </span><span class="token operator">=</span><span class=""> </span><span class="token punctuation">{</span><span class="">
195</span></span><span class=""><span class="">    </span><span class="token string">&quot;Authorization&quot;</span><span class="token punctuation">:</span><span class=""> </span><span class="token string">&quot;Bearer 49e5e7785e4e4f688aa49e2585970370&quot;</span><span class="">
196</span></span><span class=""><span class="">  </span><span class="token punctuation">}</span><span class="">
197</span></span><span class=""><span class=""></span><span class="token punctuation">)</span></span></code></pre></div></div><div class="row"><div class="col-lg-9"><p>The transmitter will reply with a 200 OK response. Now any events that MostSecure sees that reference Reginold will be added to the stream.</p></div></div></div><div class="section" id="requestverification"><div class="row"><div class="col-lg-9"><h3>
197Request a Verification Event</h3><p>It&#x27;s time to make sure everything is wired up correctly!</p><p>The receiver can make an HTTPS POST request to the transmitter&#x27;s verification endpoint to ask for an example Security Event Token to be sent over the stream.</p></div></div><div class="syntax-highlighter-row row"><div class="col-lg-12"><pre class="language-python"><code><span class=""><span class="">verification_response </span><span class="token operator">=</span><span class=""> requests</span><span class="token punctuation">.</span><span class="">post</span><span class="token punctuation">(</span><span class="">
198</span></span><span class="shadowed"><span class="">  </span><span class="token comment"># Note that the request posts to the verification_endpoint of the ssf_config</span><span class="">
199</span></span><span class="shadowed"><span class="">  </span><span class="token comment"># returned in the first example.</span><span class="">
200</span></span><span class=""><span class="">  url</span><span class="token operator">=</span><span class="">ssf_config</span><span class="token punctuation">[</span><span class="token string">&quot;verification_endpoint&quot;</span><span class="token punctuation">]</span><span class="token punctuation">,</span><span class="">
201</span></span><span class=""><span class="">  json</span><span class="token operator">=</span><span class="token punctuation">{</span><span class="">
202</span></span><span class="shadowed"><span class="">    </span><span class="token comment"># Indicate which stream we are requesting a verification event from.</span><span class="">
203</span></span><span class=""><span class="">    </span><span class="token string">&quot;stream_id&quot;</span><span class="token punctuation">:</span><span class=""> </span><span class="token string">&quot;e5d230dc-0ebe-455a-b22c-54b29f4d6f6&quot;</span><span class="token punctuation">,</span><span class="">
204</span></span><span class="shadowed"><span class="">    </span><span class="token comment"># This optional attribute, if included, ensures that the verification event</span><span class="">
205</span></span><span class="shadowed"><span class="">    </span><span class="token comment"># generated by this request will also include the state in the event data.</span><span class="">
206</span></span><span class=""><span class="">    </span><span class="token string">&quot;state&quot;</span><span class="token punctuation">:</span><span class=""> </span><span class="token string">&quot;VGhpcyBpcyBhbiBleG&quot;</span><span class="">
207</span></span><span class=""><span class="">  </span><span class="token punctuation">}</span><span class="token punctuation">,</span><span class="">
208</span></span><span class=""><span class="">  headers</span><span class="token operator">=</span><span class="token punctuation">{</span><span class="">
209</span></span><span class=""><span class="">    </span><span class="token string">&quot;Authorization&quot;</span><span class="token punctuation">:</span><span class=""> </span><span class="token string">&quot;Bearer 49e5e7785e4e4f688aa49e2585970370&quot;</span><span class="">
210</span></span><span class=""><span class="">  </span><span class="token punctuation">}</span><span class="">
211</span></span><span class=""><span class=""></span><span class="token punctuation">)</span></span></code></pre></div></div><div class="row"><div class="col-lg-9"><p>The transmitter will reply with an empty 204 response, indicating the request came through loud and clear, and a verification event will be queued up for delivery.</p></div></div></div><div class="section" id="pollevents"><div class="row"><div class="col-lg-9"><h3>Poll For Events</h3><p>At this point we’ve got a fully configured event stream, and there’s an event waiting for us. We’ve configured the stream to use the polling delivery method, so let’s make an HTTPS POST request to the transmitter’s polling endpoint to retrieve that event now.</p></div></div><div class="syntax-highlighter-row row"><div class="col-lg-12"><pre class="language-python"><code><span class=""><span class="">polling_response </span><span class="token operator">=</span><span class=""> requests</span><span class="token punctuation">.</span><span class="">post</span><span class="token punctuation">(</span><span class="">
212</span></span><span class="shadowed"><span class="">  </span><span class="token comment"># Note that this request posts to the delivery endpoint returned when we created</span><span class="">
213</span></span><span class="shadowed"><span class="">  </span><span class="token comment"># the stream, not to one of the initial set of well-known endpoints we&#x27;ve been</span><span class="">
214</span></span><span class="shadowed"><span class="">  </span><span class="token comment"># using until now.</span><span class="">
215</span></span><span class=""><span class="">  url</span><span class="token operator">=</span><span class="">stream_config</span><span class="token punctuation">[</span><span class="token string">&quot;delivery&quot;</span><span class="token punctuation">]</span><span class="token punctuation">[</span><span class="token string">&quot;endpoint_url&quot;</span><span class="token punctuation">]</span><span class="token punctuation">,</span><span class="">
216</span></span><span class=""><span class="">  json</span><span class="token operator">=</span><span class="token punctuation">{</span><span class="">
217</span></span><span class="shadowed"><span class="">    </span><span class="token comment"># An optional integer value indicating the maximum number of events to be returned.</span><span class="">
218</span></span><span class="shadowed"><span class="">    </span><span class="token comment"># If more than the maximum number of events are available, the event transmitter</span><span class="">
219</span></span><span class="shadowed"><span class="">    </span><span class="token comment"># determines an appropriate algorithm by which to return them. If this parameter is</span><span class="">
220</span></span><span class="shadowed"><span class="">    </span><span class="token comment"># omitted, the transmitter may return any number of events.</span><span class="">
221</span></span><span class=""><span class="">    </span><span class="token string">&quot;maxEvents&quot;</span><span class="token punctuation">:</span><span class=""> </span><span class="token number">1</span><span class="token punctuation">,</span><span class="">
222</span></span><span class="shadowed"><span class="">    </span><span class="token comment"># An optional boolean value that indicates the transmitter should return an</span><span class="">
223</span></span><span class="shadowed"><span class="">    </span><span class="token comment"># immediate response even if fewer than maxEvents results are available</span><span class="">
224</span></span><span class="shadowed"><span class="">    </span><span class="token comment"># (short polling). The default value is false, which indicates the request is to</span><span class="">
225</span></span><span class="shadowed"><span class="">    </span><span class="token comment"># be treated as an HTTP long poll. A long polling request will always return 1 or</span><span class="">
226</span></span><span class="shadowed"><span class="">    </span><span class="token comment"># more events, unless a timeout is reached.</span><span class="">
227</span></span><span class=""><span class="">    </span><span class="token string">&quot;returnImmediately&quot;</span><span class="token punctuation">:</span><span class=""> </span><span class="token boolean">True</span><span class="">
228</span></span><span class=""><span class="">  </span><span class="token punctuation">}</span><span class="token punctuation">,</span><span class="">
229</span></span><span class=""><span class="">  headers</span><span class="token operator">=</span><span class="token punctuation">{</span><span class="">
230</span></span><span class=""><span class="">    </span><span class="token string">&quot;Authorization&quot;</span><span class="token punctuation">:</span><span class=""> </span><span class="token string">&quot;Bearer 49e5e7785e4e4f688aa49e2585970370&quot;</span><span class="">
231</span></span><span class=""><span class="">  </span><span class="token punctuation">}</span><span class="">
232</span></span><span class=""><span class=""></span><span class="token punctuation">)</span><span class="">
233</span></span><span class=""><span class="">events </span><span class="token operator">=</span><span class=""> polling_response</span><span class="token punctuation">.</span><span class="">json</span><span class="token punctuation">(</span><span class="token punctuation">)</span></span></code></pre></div></div><div class="row"><div class="col-lg-9"><p>In a polling configuration, the event transmitter queues events in a buffer so that a recipient can poll for them using HTTPS POST requests to a pre-arranged endpoint. The request parameters can be configured to customize the response into a short-polling response or a long-polling response.</p><p>Alternatively, we could have set up the delivery to use a push configuration, in 
233which the transmitter sends events one-at-a-time to an endpoint configured by the receiver. To read more about this stream strategy, see our tutorial on<!-- --> <a rel="noopener" href="https://github.com/duo-labs/sharedsignals/blob/main/docs/setting-up-push-delivery.md" target="_blank">Setting Up PUSH Delivery.</a></p></div></div><div class="row"><div class="col-lg-9"><p>When PopularApp calls MostSecure&#x27;s polling endpoint, any available events are returned in a JSON document.</p></div></div><div class="syntax-highlighter-row row"><div class="col-lg-12"><pre class="language-json"><code><span class=""><span class="token punctuation">{</span><span class="">
234</span></span><span class="shadowed"><span class="">  # A JSON object containing zero or more Security Event Tokens (SETs</span><span class="token punctuation">)</span><span class="">.
235</span></span><span class="shadowed"><span class="">  # Each member name is the jti (a unique identifier for the event</span><span class="token punctuation">)</span><span class=""> of an event</span><span class="token punctuation">,</span><span class="">
236</span></span><span class="shadowed">  # and its value is a string representing the event as an encoded JWT.
237</span><span class=""><span class="">  </span><span class="token property">&quot;sets&quot;</span><span class="token operator">:</span><span class=""> </span><span class="token punctuation">{</span><span class="">
238</span></span><span class=""><span class="">    </span><span class="token property">&quot;1767b10443e511eca7740242ac120002&quot;</span><span class="token operator">:</span><span class=""> </span><span class="token string">&quot;eyJ0eXAiOiJzZWNldmVudCtqd...&quot;</span><span class="">
239</span></span><span class=""><span class="">  </span><span class="token punctuation">}</span><span class="token punctuation">,</span><span class="">
240</span></span><span class="shadowed">  # A boolean value that indicates if more unacknowledged events are available
241</span><span class="shadowed"><span class="">  # to be returned. If omitted</span><span class="token punctuation">,</span><span class=""> the receiver may assume no more events are available.
242</span></span><span class=""><span class="">  </span><span class="token property">&quot;moreAvailable&quot;</span><span class="token operator">:</span><span class=""> </span><span class="token boolean">false</span><span class="">
243</span></span><span class=""><span class=""></span><span class="token punctuation">}</span></span></code></pre></div></div><div class="row"><div class="col-lg-9"><p>The SET in this response has been encoded as a<!-- --> <a rel="noopener" href="https://jwt.io/#debugger-io?token=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJqdGkiOiJiZDI4MjU0YTM1YTUxMWVjYmNhMjAyNDJhYzFjMDAwMiIsImlhdCI6MTYzNTE3NDY1MCwiaXNzIjoiaHR0cHM6Ly9tb3N0LXNlY3VyZS5jb20vIiwiYXVkIjoiaHR0cHM6Ly9wb3B1bGFyLWFwcC5jb20iLCJldmVudHMiOnsiaHR0cHM6Ly9zY2hlbWFzLm9wZW5pZC5uZXQvc2VjZXZlbnQvc3NlL2V2ZW50LXR5cGUvdmVyaWZpY2F0aW9uIjp7InN0YXRlIjoiVkdocGN5QnBjeUJoYmlCbGVHIn19fQ.3AhVkTUewR6tqhcoCc-Jw_iSi-fJb5jeTgIMaF5609I" target="_blank">JSON Web Token (JWT)</a> <!-- -->and signed with the ES256 algorithm. We can use the JSON Web Key Set (JWKS) downloaded from the “jwks_uri” in the Transmitter Configuration above to verify that this signature is from the Transmitter and not some malicious third party. To view the technical details of verifying a signature with ES256, see our tutorial document on<!-- --> <a rel="noopener" href="https://github.com/duo-labs/sharedsignals/blob/main/docs/decoding-sets.md" target="_blank">Decoding SETs.</a> <!-- -->Here&#x27;s what it looks like after decoding.</p></div></div><div class="syntax-highlighter-row row"><div class="col-lg-12"><pre class="language-json"><code><span class=""><span class="token punctuation">{</span><span class="">
244</span></span><span class="shadowed"><span class="">  # Short for &#x27;JWT ID&#x27;</span><span class="token punctuation">,</span><span class=""> this is a unique identifier for the SET.
245</span></span><span class="shadowed">  # It allows receivers to determine whether they have already processed
246</span><span class="shadowed">  # this SET. Notice that it matches the key in the &#x27;sets&#x27; object returned
247</span><span class="shadowed">  # from the polling endpoint.
248</span><span class=""><span class="">  </span><span class="token property">&quot;jti&quot;</span><span class="token operator">:</span><span class=""> </span><span class="token string">&quot;1767b10443e511eca7740242ac120002&quot;</span><span class="token punctuation">,</span><span class="">
249</span></span><span class="shadowed"><span class="">  # This stands for </span><span class="token string">&quot;issued at&quot;</span><span class=""> and describes the timestamp (in
250</span></span><span class="shadowed"><span class="">  # seconds since the epoch</span><span class="token punctuation">)</span><span class=""> that the SET was issued.
251</span></span><span class=""><span class="">  </span><span class="token property">&quot;iat&quot;</span><span class="token operator">:</span><span class=""> </span><span class="token number">1636741176</span><span class="token punctuation">,</span><span class="">
252</span></span><span class="shadowed">  # Identifies the issuer of the SET. It uniquely identifies the
253</span><span class="shadowed">  # transmitter of the security event. It must match the
254</span><span class="shadowed">  # issuer in the stream configuration.
255</span><span class=""><span class="">  </span><span class="token property">&quot;iss&quot;</span><span class="token operator">:</span><span class=""> </span><span class="token string">&quot;https://most-secure.com/&quot;</span><span class="token punctuation">,</span><span class="">
256</span></span><span class="shadowed">
256  # This is an identifier that the receiver can use to ensure
257</span><span class="shadowed">  # the SET is meant for them to process. The value can be a single string or a
258</span><span class="shadowed">  # list of strings. It must be the same value returned in the stream configuration.
259</span><span class="shadowed"><span class="">  # If the receiver does not recognize the value</span><span class="token punctuation">,</span><span class=""> it should NOT process the SET.
260</span></span><span class=""><span class="">  </span><span class="token property">&quot;aud&quot;</span><span class="token operator">:</span><span class=""> </span><span class="token string">&quot;a7447d1d-9a0c-4e4e-b1bb-265dab64fa8&quot;</span><span class="token punctuation">,</span><span class="">
261</span></span><span class="shadowed">  # Identifies the underlying event that caused the transmitter to generate the
262</span><span class="shadowed">  # Security Event Token. This value can be used to tie multiple events together
263</span><span class="shadowed"><span class="">  # with a single underlying cause (for instance</span><span class="token punctuation">,</span><span class=""> a session revoked and
264</span></span><span class="shadowed"><span class="">  # credential change both triggered by the same underlying detection</span><span class="token punctuation">)</span><span class="">.
265</span></span><span class=""><span class="">  </span><span class="token property">&quot;txn&quot;</span><span class="token operator">:</span><span class=""> </span><span class="token string">&quot;3287818&quot;</span><span class="token punctuation">,</span><span class="">
266</span></span><span class="shadowed"><span class="">  # This identifies the subject of the event. In this case</span><span class="token punctuation">,</span><span class=""> the subject of the
267</span></span><span class="shadowed"><span class="">  # event is the stream itself</span><span class="token punctuation">,</span><span class=""> since we are verifying that it is operational.
268</span></span><span class="shadowed">  # So the subject is in the “opaque” format with the id being the stream_id
269</span><span class="shadowed"><span class="">  # of the stream being verified. In other events</span><span class="token punctuation">,</span><span class=""> this field will tell you
270</span></span><span class="shadowed">  # what user the event is about and will match the subject formats that you
271</span><span class="shadowed">  # added to the stream earlier.
272</span><span class=""><span class="">  </span><span class="token property">&quot;sub_id&quot;</span><span class="token operator">:</span><span class=""> </span><span class="token punctuation">{</span><span class="">
273</span></span><span class=""><span class="">      </span><span class="token property">&quot;format&quot;</span><span class="token operator">:</span><span class=""> </span><span class="token string">&quot;opaque&quot;</span><span class="token punctuation">,</span><span class="">
274</span></span><span class=""><span class="">      </span><span class="token property">&quot;id&quot;</span><span class="token operator">:</span><span class=""> </span><span class="token string">&quot;e5d230dc-0ebe-455a-b22c-54b29f4d6f6&quot;</span><span class="">
275</span></span><span class=""><span class="">  </span><span class="token punctuation">}</span><span class="">
276</span></span><span class="shadowed">  # A map of event URIs to event details. There should only be one event per SET.
277</span><span class="shadowed">  # The event details JSON will vary depending on event type.
278</span><span class="shadowed">  # The keys used to describe the event details are standardized and
279</span><span class="shadowed"><span class="">  # described in the CAEP</span><span class="token punctuation">,</span><span class=""> RISC</span><span class="token punctuation">,</span><span class=""> and SCIM event specs.
280</span></span><span class=""><span class="">  </span><span class="token property">&quot;events&quot;</span><span class="token operator">:</span><span class=""> </span><span class="token punctuation">{</span><span class="">
281</span></span><span class=""><span class="">    </span><span class="token property">&quot;https://schemas.openid.net/secevent/sse/event-type/verification&quot;</span><span class="token operator">:</span><span class=""> </span><span class="token punctuation">{</span><span class="">
282</span></span><span class="shadowed"><span class="">
282      # If the verification request included a state value</span><span class="token punctuation">,</span><span class=""> it will appear
283</span></span><span class="shadowed">      # here in the event. Note that this matches the state value sent to
284</span><span class="shadowed">      # the verification endpoint above.
285</span><span class=""><span class="">      </span><span class="token property">&quot;state&quot;</span><span class="token operator">:</span><span class=""> </span><span class="token string">&quot;VGhpcyBpcyBhbiBleG&quot;</span><span class="">
286</span></span><span class=""><span class="">    </span><span class="token punctuation">}</span><span class="">
287</span></span><span class=""><span class="">  </span><span class="token punctuation">}</span><span class="">
288</span></span><span class=""><span class=""></span><span class="token punctuation">}</span></span></code></pre></div></div><div class="row"><div class="col-lg-9"><p>Finally, let&#x27;s acknowledge that we received the event successfully by making another polling request.</p></div></div><div class="syntax-highlighter-row row"><div class="col-lg-12"><pre class="language-python"><code><span class="shadowed"><span class=""> </span><span class="token comment"># Grab the jtis that we want to acknowledge from the response json in &quot;events&quot;</span><span class="">
289</span></span><span class=""><span class="">jtis_to_ack </span><span class="token operator">=</span><span class=""> </span><span class="token builtin">list</span><span class="token punctuation">(</span><span class="">events</span><span class="token punctuation">[</span><span class="token string">&quot;sets&quot;</span><span class="token punctuation">]</span><span class="token punctuation">.</span><span class="">keys</span><span class="token punctuation">(</span><span class="token punctuation">)</span><span class="token punctuation">)</span><span class="">
290</span></span><span class=""><span class="">requests</span><span class="token punctuation">.</span><span class="">post</span><span class="token punctuation">(</span><span class="">
291</span></span><span class="shadowed"><span class="">  </span><span class="token comment"># Acknowledgement of the events and requesting new events both use the same endpoint.</span><span class="">
292</span></span><span class=""><span class="">  url</span><span class="token operator">=</span><span class="">stream_config</span><span class="token punctuation">[</span><span class="token string">&quot;delivery&quot;</span><span class="token punctuation">]</span><span class="token punctuation">[</span><span class="token string">&quot;endpoint_url&quot;</span><span class="token punctuation">]</span><span class="token punctuation">,</span><span class="">
293</span></span><span class=""><span class="">  json</span><span class="token operator">=</span><span class="token punctuation">{</span><span class="">
294</span></span><span class="shadowed"><span class="">    </span><span class="token comment"># An optional array of strings whose values are the jti values of successfully</span><span class="">
295</span></span><span class="shadowed"><span class="">    </span><span class="token comment"># received events that are being acknowledged. Once an event has been acknowledged,</span><span class="">
296</span></span><span class="shadowed"><span class="">    </span><span class="token comment"># the transmitter is released from any obligation to retain the event.</span><span class="">
297</span></span><span class=""><span class="">    </span><span class="token string">&quot;acks&quot;</span><span class="token punctuation">:</span><span class=""> jtis_to_ack</span><span class="token punctuation">,</span><span class="">
298</span></span><span class="shadowed"><span class="">    </span><span class="token comment"># The acknowledgement payload doubles in purpose as the subsequent</span><span class="">
299</span></span><span class="shadowed"><span class="">    </span><span class="token comment"># request payload. In this example, we’d like to “disconnect” from the event stream</span><span class="">
300</span></span><span class="shadowed"><span class="">    </span><span class="token comment"># at this point, so we set this value to 0, meaning 0 events will be returned.</span><span class="">
301</span></span><span class="shadowed"><span class="">    </span><span class="token comment"># If we wanted to continue receiving events, we could set this to a non-zero value.</span><span class="">
302</span></span><span class=""><span class="">    </span><span class="token string">&quot;maxEvents&quot;</span><span class="token punctuation">:</span><span class=""> </span><span class="token number">0</span><span class="token punctuation">,</span><span class="">
303</span></span><span class=""><span class="">    </span><span class="token string">&quot;returnImmediately&quot;</span><span class="token punctuation">:</span><span class=""> </span><span class="token boolean">True</span><span class="token punctuation">,</span><span class="">
304</span></span><span class=""><span class="">  </span><span class="token punctuation">}</span><span class="token punctuation">,</span><span class="">
305</span></span><span class=""><span class="">  headers</span><span class="token operator">=</span><span class="token punctuation">{</span><span class="">
306</span></span><span class=""><span class="">    </span><span class="token string">&quot;Authorization&quot;</span><span class="token punctuation">:</span><span class=""> </span><span class="token string">&quot;Bearer 49e5e7785e4e4f688aa49e2585970370&quot;</span><span class="token punctuation">,</span><span class="">
307</span></span><span class=""><span class="">  </span><span class="token punctuation">}</span><span class="">
308</span></span><span class=""><span class=""></span><span class="token punctuation">)</span></span></code></pre></div></div><div class="row"><div class="col-lg-9"><p>You now know how to retrieve events from the stream. If you poll at regular intervals, you are sure to see some events from MostSecure about your user [email protected]. When you get those events, you can take the appropriate actions to make sure your users maintain the high security that makes PopularApp so... popular.</p></div></div></div></div></div><div class="blue-bg mb-5 row"><div class="contentCol col"><div id="lookingforward" class="section"><div class="row">
308<div class="mt-3 col-lg-9"><h2>Looking Forward</h2><p>The SSF standard is still very new, but its potential impact is vast. In the coming years, the standard could provide the foundation for novel and innovative approaches to access management, session revocation, and detection and response. By implementing the standard now, companies can lay the groundwork for more continuous and dynamic implementations of Zero Trust.</p></div></div></div></div></div><div class="row"><div class="contentCol col"><div id="eventdefinitions" class="section"><div class="row"><div class="col-lg-9"><h2>Event Type Definitions</h2><p>The Shared Signals Framework is currently designed to send two kinds of events across these streams: CAEP Events and RISC Events. CAEP Events generally describe changes to a subject&#x27;s session, while RISC events describe changes to a subject&#x27;s account. Events are listed in the &quot;events&quot; claim of a SET as a JSON object that maps event URIs to JSON objects of event claims.</p></div></div></div><div id="caepevents" class=" section row"><div class="mx-0 row"><div class="col-lg-9"><h3>CAEP Events</h3><p>All CAEP events have four generic event claims and zero or more event-specific claims. The generic event claims are:</p><ul><li><code>initiating_entity</code>: [OPTIONAL] The entity that invoked the event. Must be one of &quot;admin&quot;, &quot;user&quot;, &quot;policy&quot;, or &quot;system&quot;.</li><li><code>reason_admin</code>: [OPTIONAL] A mapping of language codes to free-form text giving administrative explanations of the event for logging or auditing.</li><li><code>reason_user</code>: [OPTIONAL] A mapping of language codes to free-form text giving user-friendly explanations of the event for displaying to the end-user.</li><li><code>event_timestamp</code>: [OPTIONAL] The timestamp (in seconds since the epoch) at which the event described by this SET occurred. Note that this can be different from &quot;iat&quot; which describes the time the SET was added to the stream.</li></ul></div></div><div id="caep_session_revoked" class="event-row row"><div class="col"><div class="card"><div class="event-header card-header"><big>Session Revoked</big> [<a rel="noopener" href="https://openid.net/specs/openid-caep-specification-1_0.html#session-revoked" target="_blank">spec</a>]<span class="accordion-indicator">+</span></div><div class="collapse"><div class="card-body"><p>URI: <code>https://schemas.openid.net/secevent/caep/event-type/session-revoked</code></p><p>This event indicates that a subject&#x27;s session has been revoked for some reason.</p><div><p>Event specific claims:</p><p class="no-event-claims"> <i>It does not have any event-specific claims</i></p></div></div></div></div></div></div><div id="caep_token_claims_change" class="event-row row"><div class="col"><div class="card"><div class="event-header card-header"><big>Token Claims Change</big> [<a rel="noopener" href="https://openid.net/specs/openid-caep-specification-1_0.html#token-claims-change" target="_blank">spec</a>]<span class="accordion-indicator">+</span></div><div class="collapse"><div class="card-body"><p>URI: <code>https://schemas.openid.net/secevent/caep/event-type/token-claims-change</code></p><p>This event indicates that one or more of the claims in a subject&#x27;s token has changed. For instance, this could indicate that the role granted to a user in their access token has changed.</p><div><p>Event specific claims:</p><ul><li><code>claim</code>: [REQUIRED] A JSON object containing one or more claims and their new values.</li></ul></div></div></div></div></div></div><div id="caep_credential_change" class="event-row row"><div class="col"><div class="card"><div class="event-header card-header"><big>Credential Change</big> [<a rel="noopener" href="https://openid.net/specs/openid-caep-specification-1_0.html#rfc.section.3.3" target="_blank">spec</a>]<span class="accordion-indicator">+</span></div><div class="collapse"><div class="card-body"><p>URI: <code>https://schemas.openid.net/secevent/caep/event-type/credential-change</code></p><p>This event indicates that a credential was created, changed, revoked or deleted. For example a password reset, a certificate renewal, or two factor enrollment.</p><div><p>Event specific claims:</p><ul><li><code>credential_type</code>: [REQUIRED] A string identifying the credential type. This must be one of the following values, or any other credential type supported mutually by the Transmitter and the Receiver:<ul><li>password</li><li>pin</li><li>x509</li><li>fido2-platform</li><li>fido2-roaming</li><li>fido-u2f</li><li>verifiable-credential</li><li>phone-voice</li><li>phone-sms</li><li>app</li></ul></li><li><code>change_type</code>: [REQUIRED] A string that must be one of the following values:<ul><li>create</li><li>revoke</li><li>update</li><li>
308delete</li></ul></li><li><code>friendly_name</code>: [OPTIONAL] A string indicating the credential friendly name</li><li><code>x509_issuer</code>: [OPTIONAL] A string indicating issuer of the X.509 certificate as defined in [<a rel="noopener" href="https://openid.net/specs/openid-caep-specification-1_0.html#RFC5280" target="_blank">RFC5280</a>], if applicable</li><li><code>x509_serial</code>: [OPTIONAL] A string indicating the serial number of the X.509 certificate as defined in [<a rel="noopener" href="https://openid.net/specs/openid-caep-specification-1_0.html#RFC5280" target="_blank">RFC5280</a>], if applicable</li><li><code>fido2_aaguid</code>: [OPTIONAL] A string indicating the FIDO2 Authenticator Attestation GUID as defined in [<a rel="noopener" href="https://openid.net/specs/openid-caep-specification-1_0.html#WebAuthn" target="_blank">WebAuthn</a>], if applicable</li></ul></div></div></div></div></div></div><div id="caep_assurance_level_change" class="event-row row"><div class="col"><div class="card"><div class="event-header card-header"><big>Assurance Level Change</big> [<a rel="noopener" href="https://openid.net/specs/openid-caep-specification-1_0.html#rfc.section.3.4" target="_blank">spec</a>]<span class="accordion-indicator">+</span></div><div class="collapse"><div class="card-body"><p>URI: <code>https://schemas.openid.net/secevent/caep/event-type/assurance-level-change</code></p><p>This event indicates that there has been a change in authentication method since the initial user login. This change can be from a weak authentication method to a strong authentication method, or vice versa. For example, if a user authenticates to Service Provider A using password, then authenticates to Service Provider B using two-factor authentication, an assurance level change should be sent to Service Provider A to inform them of the increased assurance level.</p><div><p>Event specific claims:</p><ul><li><code>current_level</code>: [REQUIRED] A string indicating the current NIST Authenticator Assurance Level (AAL) as defined in [<a rel="noopener" href="https://openid.net/specs/openid-caep-specification-1_0.html#SP800-63R3" target="_blank">SP800-63R3</a>]. It must be one of the following strings:<ul><li>nist-aal1</li><li>nist-aal2</li><li>nist-aal3</li></ul></li><li><code>previous_level</code>: [REQUIRED] A string indicating the previous NIST AAL. It shares the same value constraints as current_level</li><li><code>change_direction</code>: [REQUIRED] A string indicating the AAL increased or decreased. Its value must be “increase” or “decrease”</li></ul></div></div></div></div></div></div><div id="caep_device_compliance_change" class="event-row row"><div class="col"><div class="card"><div class="event-header card-header"><big>Device Compliance Change</big> [<a rel="noopener" href="https://openid.net/specs/openid-caep-specification-1_0-ID1.html#rfc.section.3.5" target="_blank">spec</a>]<span class="accordion-indicator">+</span></div><div class="collapse"><div class="card-body"><p>URI: <code>https://schemas.openid.net/secevent/caep/event-type/device-compliance-change</code></p><p>This event indicates that a device&#x27;s compliance status has changed. The actual reason why the status change occurred might be specified with the core CAEP event claims reason_admin and/or reason_user</p><div><p>Event specific claims:</p><ul><li><code>previous_status</code>: [REQUIRED] A string indicating the compliance status prior to the change that triggered the event. Its value must be “compliant” or “not-compliant”</li><li><code>current_status</code>: [REQUIRED] A string indicating the current status that triggered the event. Its value must be “compliant” or “not-compliant”</li></ul></div></div></div></div></div></div></div><div id="riscevents" class=" section row"><div class="mx-0 row"><div class="col-lg-9"><h3>RISC Events</h3><p>RISC and CAEP events share structural similarities since both event types are represented as SETs. Unlike CAEP, RISC events do not have any common optional claims -- each event type has a unique set of claims.</p></div></div><div id="risc_account_credential_change_required" class="event-row row"><div class="col"><div class="card"><div class="event-header card-header"><big>Account Credential Change Required</big> [<a rel="noopener" href="https://openid.net/specs/openid-risc-profile-specification-1_0-01.html#rfc.section.2.1" target="_blank">spec</a>]<span class="accordion-indicator">+</span></div><div class="collapse"><div class="card-body"><p>URI: <code>https://schemas.openid.net/secevent/risc/event-type/account-credential-change-required</code></p><p>This event indicates that the account identified by the subject was required to change a credential. For example the user was required to go through a password change</p><div><p>Event specific claims:</p><p class="no-event-claims"> <i>It does not have any event-specific claims</i></p></div></div></div></div></div></div><div id="risc_account_purged" class="event-row row"><div class="col"><div class="card"><div class="event-header card-header"><big>Account Purged</big> [<a rel="noopener" href="https://openid.net/specs/openid-risc-profile-specification-1_0-01.html#rfc.section.2.2" target="_blank">spec</a>]<span class="accordion-indicator">+</span></div><div class="collapse"><div class="card-body"><p>URI: <code>https://schemas.openid.net/secevent/risc/event-type/account-purged</code></p><p>This event indicates that the account identified by the subject has been permanently deleted.</p><div><p>Event specific claims:</p><p class="no-event-claims"> <i>It does not have any event-specific claims</i></p></div></div></div></div></div></div><div id="risc_account_disabled" class="event-row row"><div class="col"><div class="card"><div class="event-header card-header"><big>Account Disabled</big> [<a rel="noopener" href="https://openid.net/specs/openid-risc-profile-specification-1_0-01.html#rfc.section.2.3" target="_blank">spec</a>]<span class="accordion-indicator">+</span></div><div class="collapse"><div class="card-body"><p>URI: <code>https://schemas.openid.net/secevent/risc/event-type/account-disabled</code></p><p>This event indicates that the account identified by the subject has been disabled. The actual reason why the account was disabled might be specified with the nested reason attribute described below. The account may be enabled in the future.</p><div><p>Event specific claims:</p><ul><li><code>reason</code>: [OPTIONAL] A string indicating why the account was disabled. Possible values include but are not limited to<ul><li>hijacking</li><li>bulk-account</li></ul></li></ul></div></div></div></div></div></div><div id="risc_account_enabled" class="event-row row"><div class="col"><div class="card"><div class="event-header card-header"><big>Account Enabled</big> [<a rel="noopener" href="https://openid.net/specs/openid-risc-profile-specification-1_0-01.html#rfc.section.2.4" target="_blank">spec</a>]<span class="accordion-indicator">+</span></div><div class="collapse"><div class="card-body"><p>URI: <code>https://schemas.openid.net/secevent/risc/event-type/account-enabled</code></p><p>This event indicates that the account identified by the subject has been enabled.</p><div><p>Event specific claims:</p><p class="no-event-claims"> <i>It does not have any event-specific claims</i></p></div></div></div></div></div></div><div id="risc_identifier_changed" class="event-row row"><div class="col"><div class="card"><div class="event-header card-header"><big>Identifier Changed</big> [<a rel="noopener" href="https://openid.net/specs/openid-risc-profile-specification-1_0-01.html#rfc.section.2.5" target="_blank">spec</a>]<span class="accordion-indicator">+</span></div><div class="collapse"><div class="card-body"><p>URI: <code>https://schemas.openid.net/secevent/risc/event-type/identifier-changed</code></p><p>This event indicates that an email or phone identifier has changed.</p><div><p>Event specific claims:</p><ul><li><code>new-value</code>: [OPTIONAL] A string indicating the new value of the identifier</li></ul></div></div></div></div></div></div><div id="risc_identifier_recycled" class="event-row row"><div class="col"><div class="card"><div class="event-header card-header"><big>Identifier Recycled</big> [<a rel="noopener" href="https://openid.net/specs/openid-risc-profile-specification-1_0-01.html#rfc.section.2.6" target="_blank">spec</a>]<span class="accordion-indicator">+</span></div><div class="collapse"><div class="card-body"><p>URI: <code>https://schemas.openid.net/secevent/risc/event-type/identifier-recycled</code></p><p>This event indicates that an email or phone identifier has been recycled and now belongs to a new user.</p><div><p>Event specific claims:</p><p class="no-event-claims"> <i>It does not have any event-specific claims</i></p></div></div></div></div></div></div><div id="risc_credential_compromised" class="event-row row"><div class="col"><div class="card"><div class="event-header card-header"><big>Credential Compromise</big> [<a rel="noopener" href="https://openid.net/specs/openid-risc-profile-specification-1_0-01.html#rfc.section.2.7" target="_blank">spec</a>]<span class="accordion-indicator">+</span></div><div class="collapse"><div class="card-body"><p>URI: <code>https://schemas.openid.net/secevent/risc/event-type/credential-compromise</code></p><p>This event indicates that the identifier specified in the subject was found to be compromised.</p><div><p>Event specific claims:</p><ul><li><code>credential_type</code>
308: [REQUIRED] A string that must be one of the following strings, or any other credential type supported mutually by the Transmitter and the Receiver:<ul><li>password</li><li>pin</li><li>x509</li><li>fido2-platform</li><li>fido2-roaming</li><li>fido-u2f</li><li>verifiable-credential</li><li>phone-voice</li><li>phone-sms</li><li>app</li></ul></li><li><code>reason_admin</code>: [OPTIONAL] The reason why the credential compromised event was generated, intended for administrators</li><li><code>reason_user</code>: [OPTIONAL] The reason why the credential compromised event was generated, intended for end-users</li></ul></div></div></div></div></div></div><div id="risc_opt_in" class="event-row row"><div class="col"><div class="card"><div class="event-header card-header"><big>Opt In</big> [<a rel="noopener" href="https://openid.net/specs/openid-risc-profile-specification-1_0-01.html#rfc.section.2.8.1" target="_blank">spec</a>]<span class="accordion-indicator">+</span></div><div class="collapse"><div class="card-body"><p>URI: <code>https://schemas.openid.net/secevent/risc/event-type/opt-in</code></p><p>This event indicates that the account identified by the subject opted into RISC event exch
308anges.</p><div><p>Event specific claims:</p><p class="no-event-claims"> <i>It does not have any event-specific claims</i></p></div></div></div></div></div></div><div id="risc_opt_out_initiated" class="event-row row"><div class="col"><div class="card"><div class="event-header card-header"><big>Opt Out Initiated</big> [<a rel="noopener" href="https://openid.net/specs/openid-risc-profile-specification-1_0-01.html#rfc.section.2.8.2" target="_blank">spec</a>]<span class="accordion-indicator">+</span></div><div class="collapse"><div class="card-body"><p>URI: <code>https://schemas.openid.net/secevent/risc/event-type/opt-out-initiated</code></p><p>This event indicates that the account identified by the subject initiated to opt out from RISC event exchanges</p><div><p>Event specific claims:</p><p class="no-event-claims"> <i>It does not have any event-specific claims</i></p></div></div></div></div></div></div><div id="risc_opt_out_cancelled" class="event-row row"><div class="col"><div class="card"><div class="event-header card-header"><big>Opt Out Cancelled</big> [<a rel="noopener" href="https://openid.net/specs/openid-risc-profile-specification-1_0-01.html#rfc.section.2.8.3" target="_blank">spec</a>]<span class="accordion-indicator">+</span></div><div class="collapse"><div class="card-body"><p>URI: <code>https://schemas.openid.net/secevent/risc/event-type/opt-out-cancelled</code></p><p>This event indicates that the account identified by the subject cancelled the opt out from RISC event exch
308anges.</p><div><p>Event specific claims:</p><p class="no-event-claims"> <i>It does not have any event-specific claims</i></p></div></div></div></div></div></div><div id="risc_opt_out_effective" class="event-row row"><div class="col"><div class="card"><div class="event-header card-header"><big>Opt Out Effective</big> [<a rel="noopener" href="https://openid.net/specs/openid-risc-profile-specification-1_0-01.html#rfc.section.2.8.4" target="_blank">spec</a>]<span class="accordion-indicator">+</span></div><div class="collapse"><div class="card-body"><p>URI: <code>https://schemas.openid.net/secevent/risc/event-type/opt-out-effective</code></p><p>This event indicates that the account identified by the subject was effectively opted out from RISC event exchanges.</p><div><p>Event specific claims:</p><p class="no-event-claims"> <i>It does not have any event-specific claims</i></p></div></div></div></div></div></div><div id="risc_recovery_activated" class="event-row row"><div class="col"><div class="card"><div class="event-header card-header"><big>Recovery Activated</big> [<a rel="noopener" href="https://openid.net/specs/openid-risc-profile-specification-1_0-01.html#rfc.section.2.9" target="_blank">spec</a>]<span class="accordion-indicator">+</span></div><div class="collapse"><div class="card-body"><p>URI: <code>https://schemas.openid.net/secevent/risc/event-type/recovery-activated</code></p><p>This event indicates that the account identified by the subject activated a recovery flow.</p><div><p>Event specific claims:</p><p class="no-event-claims"> <i>It does not have any event-specific claims</i></p></div></div></div></div></div></div><div id="risc_recovery_information_changed" class="event-row row"><div class="col"><div class="card"><div class="event-header card-header"><big>Recovery Information Changed</big> [<a rel="noopener" href="https://openid.net/specs/openid-risc-profile-specification-1_0-01.html#rfc.section.2.10" target="_blank">spec</a>]<span class="accordion-indicator">+</span></div><div class="collapse"><div class="card-body"><p>URI: <code>https://schemas.openid.net/secevent/risc/event-type/recovery-information-changed</code></p><p>This event indicates that the account identified by the subject has changed some of its recovery information. For example a recovery email address was added or removed.</p><div><p>Event specific claims:</p><p class="no-event-claims"> <i>It does not have any event-specific claims</i></p></div></div></div></div></div></div><div id="risc_sessions_revoked" class="event-row row"><div class="col"><div class="card"><div class="event-header card-header"><big>Sessions Revoked</big> [<a rel="noopener" href="https://openid.net/specs/openid-risc-profile-specification-1_0-01.html#rfc.section.2.11" target="_blank">spec</a>]<span class="accordion-indicator">+</span></div><div class="collapse"><div class="card-body"><p>URI: <code>https://schemas.openid.net/secevent/risc/event-type/sessions-revoked</code></p><p>This event indicates that all the sessions for the account identified by the subject have been revoked. This event type may be removed soon, so it is not recommended to rely on it. Instead, use the<!-- --> <a href="#caep_session_revoked">CAEP Session Revoked message</a>.</p><div><p>Event specific claims:</p><p class="no-event-claims"> <i>It does not have any event-specific claims</i></p></div></div></div></div></div></div></div></div></div><div><div id="conclusion" class="section"><div class="row"><div class="contentCol col"><h2>About the Authors</h2><div class="justify-centered mx-0 row"><div class="px-2 py-4 px-md-3 py-md-2 col-md-6 col-lg-4"><div class="author-image"><img alt="Picture of website contributor Shayne Miel" src="/dist/images/shayne.svg"/></div><p><b>Shayne</b> is an architect at Cisco, working in Duo Security&#x27;s Data Science and Engineering group. He has helped drive Risk Based Authentication and Continuous Trusted Access development at Duo.</p><p>Gloomhaven, Azul, Breath of the Wild</p><p class="email-link"><a rel="noopener" href="mailto:[email protected]" target="_blank"><img alt="" role="presentation" class="email-icon" src="/dist/images/mail.svg"/></a><a rel="noopener" href="mailto:[email protected]" target="_blank">[email protected]</a></p></div><div class="px-2 py-4 px-md-3 py-md-2 col-md-6 col-lg-4"><div class="author-image"><img alt="Picture of website contributor Josh Matz" src="/dist/images/josh.svg"/></div><p><b>Josh</b> is a software engineer at Cisco, working on Duo Security&#x27;s Admin Platform team. He strives to bring an excellent user experience to the Duo Admin Panel.</p><p>Catan, Coup, Rocket League</p><p class="email-link"><a rel="noopener" href="mailto:[email protected]" target="_blank"><img alt="" role="presentation" class="email-icon" src="/dist/images/mail.svg"/></a><a rel="noopener" href="mailto:[email protected]" target="_blank">[email protected]</a></p></div><div class="px-2 py-4 px-md-3 py-md-2 col-md-6 col-lg-4"><div class="author-image"><img alt="Picture of website contributor CJ Linton" src="/dist/images/cj.svg"/></div><p><b>CJ</b> is a software engineer at Cisco, on Duo Security’s Customer Systems Platform team, creating solutions that help scale business.</p><p>Magic: the Gathering, Sushi GO, Slay the Spire</p><p class="email-link"><a rel="noopener" href="mailto:[email protected]" target="_blank"><img alt="" role="presentation" class="email-icon" src="/dist/images/mail.svg"/></a><a rel="noopener" href="mailto:[email protected]" target="_blank">[email protected]</a></p></div><div class="px-2 py-4 px-md-3 py-md-2 col-md-6 col-lg-4"><div class="author-image"><img alt="Picture of website contributor Ted Kietzman" src="/dist/images/ted.svg"/></div><p><b>Ted</b> is on the Product Team at Duo Security. He focuses on new forms of authentication and the role of analytics in access management.</p><p>Wingspan, Everdell, Pokemon Red</p><p class="email-link"><a rel="noopener" href="mailto:[email protected]" target="_blank"><img alt="" role="presentation" class="email-icon" src="/dist/images/mail.svg"/></a><a rel="noopener" href="mailto:[email protected]" target="_blank">[email protected]</a></p></div><div class="px-2 py-4 px-md-3 py-md-2 col-md-6 col-lg-4"><div class="author-image"><img alt="Picture of website contributor Emily Rosen" src="/dist/images/emily.svg"/></div><p><b>Emily</b> is a designer on the Cisco Secure Brand Team. She creates pretty pictures that tell stories about security.</p><p>Hades, Risk of Rain 2, Ocarina of Time</p><p class="email-link"><a rel="noopener" href="mailto:[email protected]" target="_blank"><img alt="" role="presentation" class="email-icon" src="/dist/images/mail.svg"/></a><a rel="noopener" href="mailto:[email protected]" target="_blank">[email protected]</a></p></div></div></div></div></div><div class="footer row"><div class="col"></div><div class="col-8 col-sm-5 col-lg-4 col-xl-3"><img alt="Duo Security logo on the left, Cisco Secure logo on the right" src="/dist/images/logos-white.svg" class="logos"/></div><div class="col"></div></div></div></main></div></div></div>
309              
310        </div>
311
312        
312<script src="/dist/js/index.js" type="text/javascript"></script>
312
313        
313<script src="/dist/js/vendor.index.js" type="text/javascript"></script>
313
314    </body>
315</html>

Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.