Single Event Syntax

[dickhardt]

Is it important to syntactically ensure that only one event is in a SET? For privacy reasons, some use cases want to ensure that only one signal is in a SET. This adds some additional complexity for use cases that want to include multiple signals in a SET.

Below is some proposed syntax that ensures one event per SET, and enables multiple events per SET when desired.

---

This specification defines the following new claims for use in the SET envelope:

event: A JSON object known as the "event payload", whose contents identify the type of event contained within the SET and contain additional information defined as part of an event type definition in a Profiling Specification.

This specification defines the following claims for use in event payloads:

event_type...
event_id...
event_subject...
event_time...

Both the SET envelope and event payload MAY contain additional claims, such as those defined in a Profiling Specification. The format and meaning of these claims is out of scope of this specification. Implementations SHOULD ignore any claims in the SET envelope or event payload that they do not understand.

The following is a non-normative example showing a SET envelope expressing a hypothetical event with two additional claims in the event payload:

   {
     "jti": "3d0c3cf797584bd193bd0fb1bd4e7d30",
     "iss": "https://transmitter.example.com",
     "aud": [ "https://receiver.example.com" ],
     "iat": 1458496025,
     "event": {
       "event_type": "https://secevent.example.com/example_event",
       "event_subject": {
         "identifier_type": "urn:ietf:params:secevent:subject:email",
         "email": "user@example.com"
       },
       "event_time": 1458492425,
       "claim_1": "foo",
       "claim_2": "bar"
     }
   }

The payload in this example contains the following:

• An "event_type" claim whose value is the URI identifying the hypothetical event type.
• An "event_subject" claim whose value identifies a subject via email address.
• An "event_time" claim whose value is the time at which the event occured.
• Two claims "claim_1" and "claim_2" that are defined by the hypothetical event type's Profiling Specification.