| AbsoluteUriAttribute | Marks a System.Uri-typed property, field, or parameter as having to be an absolute URI. Relative URIs and values that do not parse as absolute are treated as invalid by validators that honor this attribute; null values are not flagged here, leave that to System.ComponentModel.DataAnnotations.RequiredAttribute. |
| AllowedValuesAttribute | Restricts a string-valued (or string-array-valued) property, field, or parameter to a fixed set of allowed values. Typically used to constrain protocol parameters such as response_type, grant_type, or code_challenge_method to the values defined by the relevant specification. Validators consuming this attribute should reject any value not present in AllowedValues; null values are not flagged here. |
| AuthorizationHeaderAttribute | Declares that the value is the parsed HTTP Authorization request header — the scheme and credentials used by transport-level client authentication such as Basic (RFC 7617) or Bearer (RFC 6750). Purely semantic: it names the transport source and leaves the parsing mechanism to the transport layer. |
| ClientCertificateAttribute | Declares that the value is the client X.509 certificate presented at the transport layer — via mutual TLS (RFC 8705) or forwarded by a trusted reverse proxy. Purely semantic: it names the transport source and leaves the extraction mechanism to the transport layer. |
| CultureListAttribute | Declares that the value travels on the wire as a space-separated list of BCP 47 language tags while the model exposes it as an array of cultures — e.g. the OIDC ui_locales and claims_locales parameters. Purely semantic: it names the wire format and leaves the parsing mechanism to the transport layer. |
| ElementsRequiredAttribute | Applied to an array, collection, or otherwise enumerable property, field, or parameter to declare that the collection itself must be non-null and contain at least one element, and that no element inside it may be null. Useful for protocol metadata such as redirect_uris where an empty array is invalid. |
| JsonObjectAttribute | Declares that the value travels on the wire as a JSON document carried inside a single parameter — e.g. the OIDC claims parameter or RFC 9396 authorization_details. Purely semantic: it names the wire format and leaves the parsing mechanism to the transport layer. |
| RequestHeaderAttribute | Declares that the value arrives in the named HTTP request header rather than in the request payload — e.g. the compact DPoP proof JWT carried in the DPoP header per RFC 9449 §4.1. Purely semantic: it names the transport source and leaves the extraction mechanism to the transport layer. |
| SpaceSeparatedStringAttribute | Declares that the value travels on the wire as a single space-separated string while the model exposes it as an array — e.g. the OAuth 2.0 scope and acr_values parameters. Purely semantic: it names the wire format and leaves the parsing mechanism to the transport layer. |
| TotalSecondsAttribute | Declares that the value travels on the wire as an integer number of seconds while the model exposes it as a System.TimeSpan — e.g. the OIDC max_age and CIBA requested_expiry parameters. Purely semantic: it names the wire format and leaves the parsing mechanism to the transport layer. |