Claims & identifiers

How data is delivered

After login, read identity from the broker ID token (JWT) and/or UserInfo (GET /oauth2/userinfo with the broker access token). For approved clients, the platform configures the same approved claims in both unless your onboarding letter documents an exception.

Map sub to your local user record (e.g. oidc_sub). Store eid when your allow-list includes it — this is the citizen's eID card number, not the same as sub. Use rp_token (scope eid) for agreed government back-office correlation.

1. Browser returns to your callback with an authorization code.
2. Your server exchanges the code at https://localhost:9443/oauth2/token (PKCE + client secret for confidential clients).
3. Use the response access_token to call UserInfo at https://localhost:9443/oauth2/userinfo.
4. Merge UserInfo with decoded id_token claims if either source is minimal.

Broker UserInfo API

Production RPs call the SXM Identity Broker only — not the upstream eID /connect/userinfo endpoint. The broker issues an opaque access token (UUID shape); upstream eID expects a JWT access token instead.

Example request

curl -sS -H "Authorization: Bearer {broker_access_token}" \
  https://localhost:9443/oauth2/userinfo

Response fields (approved standard bundle)

Mapping to your application

Scopes

Standard sandbox bundle: openid profile email eid

Claims catalog

Default approved bundle: sub, name, given_name, family_name, email, birthdate, citizen_status, rp_token, eid.

Example ID token (illustrative)

Decoded payload only — values differ per environment and client_id. Shape matches a standard sandbox citizen with scope eid.

{
  "sub": "94900f70-d9d6-4548-965c-b96602061aa3",
  "iss": "https://{BROKER_HOST}/oauth2/token",
  "aud": "YOUR_CLIENT_ID",
  "exp": 1792401493,
  "iat": 1792397893,
  "nonce": "your-nonce",
  "name": "Michael Brown",
  "given_name": "Michael",
  "family_name": "Brown",
  "birthdate": "1990-01-15",
  "email": "michael.brown@mock.civil.sx",
  "email_verified": true,
  "citizen_status": "active",
  "rp_token": "a1b2c3d4e5f6789012345678abcdef01",
  "eid": "SXM-123456782"
}

Example UserInfo (illustrative)

Response body from GET https://localhost:9443/oauth2/userinfo for the same login. Field presence depends on scopes, allow-list, and broker configuration.

{
  "sub": "94900f70-d9d6-4548-965c-b96602061aa3",
  "birthdate": "1990-01-15",
  "name": "Michael Brown",
  "given_name": "Michael",
  "family_name": "Brown",
  "email": "michael.brown@mock.civil.sx",
  "email_verified": true,
  "username": "u3vNo_NERm31fPRzWQXbcHpbV8Bkp5KWIjxrVwPJ4bY",
  "citizen_status": "active",
  "rp_token": "a1b2c3d4e5f6789012345678abcdef01",
  "eid": "SXM-123456782"
}

Withheld by default

FAQ: Missing claims

Related

Integration standard · Quickstart · UserInfo API