A JWT that was signed using one of the following algorithms: RS512, ES256, EdDSA.
the payload object of the JWT is structured in the next format:

• srv: (type: string, required, pattern:^(ais|move)/(user|tpp)$) contains 2 parts: the service (ais=account data, move=only for using in feezback move) and the access level (user=allows creating and managing user’s consents/payments; tpp=allows reading data of or performing actions on all users resources)
• sub: (type: string, required) for user access level: user id. This identifier will be used for queries on this users. for tpp access level: the id of the system that will use the generated token.
• iss: (type: string, required, pattern: ^tpp/\w+$) should be the TPP ID in our systems, preceding with tpp/. Will be used, primarily, for validating the incoming token.
• iat: (type: int, required, format: int64, minimum: 1, maximum: 9999999999) Incoming token issued at time, in UNIX timestamp
• flow: (type: object, required if service is for user) Defining user’s flow (e.g. which data baskets we should display). Following the 'OnboardingFlow' schema from User API.
• exp: (type: int, not required, format: int64, minimum: 1, maximum: 9999999999) Incoming token expiration time (UNIX timestamp), needed for validation of the incoming JWT
• ttl: (type: int, not required, format: int32, default: 2592000) For how long (in seconds) you want to grant access to the specified service, for validation of the generated JWT
• auth: (type: string, not required, format: uri) OAuth2 authorize URL for user authentication.