%% You should probably cite draft-ietf-ace-revoked-token-notification instead of this I-D. @techreport{tiloca-ace-revoked-token-notification-04, number = {draft-tiloca-ace-revoked-token-notification-04}, type = {Internet-Draft}, institution = {Internet Engineering Task Force}, publisher = {Internet Engineering Task Force}, note = {Work in Progress}, url = {https://datatracker.ietf.org/doc/draft-tiloca-ace-revoked-token-notification/04/}, author = {Marco Tiloca and Ludwig Seitz and Francesca Palombini and Sebastian Echeverria and Grace Lewis}, title = {{Notification of Revoked Access Tokens in the Authentication and Authorization for Constrained Environments (ACE) Framework}}, pagetotal = 34, year = ** No value found for 'doc.pub_date.year' **, month = ** No value found for 'doc.pub_date' **, day = ** No value found for 'doc.pub_date.day' **, abstract = {This document specifies a method of the Authentication and Authorization for Constrained Environments (ACE) framework, which allows an Authorization Server to notify Clients and Resource Servers (i.e., registered devices) about revoked Access Tokens. The method relies on resource observation for the Constrained Application Protocol (CoAP), with Clients and Resource Servers observing a Token Revocation List on the Authorization Server. Resulting unsolicited notifications of revoked Access Tokens complement alternative approaches such as token introspection, while not requiring additional endpoints on Clients and Resource Servers.}, }