SSF / CAEP

Validates Security Event Tokens for Shared Signals — CAEP, RISC, and SCIM events — checking JWT structure, required claims, subject identifiers, known event types, and opt-in signature verification.

Category: Identity & security
Maturity: beta
Transports: http
Content: json
Spec versions: 1.0
Tags: jwt, http, signatures

Rules (11)

Rule	Severity
`caep.event-required-fields`	error
`risc.event-fields`	error
`scim.event-fields`	error
`set.event-type-known`	warning
`set.events-map-shape`	error
`set.jwt-structure`	error
`set.no-top-level-sub`	error
`set.required-claims`	error
`set.signature-valid`	error
`set.sub-id-format`	error
`set.txn-lineage`	info