syntax = "proto3";
package spire.api.types;
option go_package = "github.com/spiffe/spire-api-sdk/proto/spire/api/types";

import "spire/api/types/spiffeid.proto";

// JWT SPIFFE Verifiable Identity Document. It contains the raw JWT token
// as well as a few denormalized fields for convenience.
message JWTSVID {
    // The serialized JWT token.
    string token = 1;

    // The SPIFFE ID of the JWT-SVID.
    spire.api.types.SPIFFEID id = 2;

    // Expiration timestamp (seconds since Unix epoch).
    int64 expires_at = 3;

    // Issuance timestamp (seconds since Unix epoch).
    int64 issued_at = 4;

    // Optional. An operator-specified string used to provide guidance on how this
    // identity should be used by a workload when more than one SVID is returned.
    // For example, `internal` and `external` to indicate an SVID for internal or
    // external use, respectively.
    string hint = 5;
}