{
  "schema": "varexis-public-evidence-record/0.3",
  "generated_at_utc": "2026-10-14T20:21:57.226Z",
  "record_id": "VXI-EXT-PROCUREMENT-AUTH0-REFRESH-REUSE-01-v1",
  "record_kind": "external_reference",
  "title": "Auth0 rotation: Reuse detection can invalidate the whole refresh family",
  "system": "Auth0",
  "evidence_family": "vendor_evidence_review",
  "index_status": "PUBLIC_SAFE_SOURCE_REVIEW",
  "evidence_state": "PRIMARY_DOCUMENTATION_REVIEW_ONLY",
  "canonical_question": "Does refresh-token rotation let an agent safely retry any old refresh token?",
  "near_questions": [
    "Can an agent retry an old rotating refresh token?",
    "What does refresh-token family invalidation mean?",
    "Can reuse detection identify the legitimate client?",
    "Does a successful refresh guarantee the next refresh succeeds?",
    "Can stale retries interrupt an authorised session?",
    "Does rotation immediately end every access-token lifetime?",
    "What evidence supports recovery after token reuse?",
    "Which logs identify a detected reuse event?",
    "Should procurement inspect client retry behaviour?",
    "Can an expired session be recovered without new authentication?",
    "When should uninterrupted-access claims remain qualified?",
    "Can I save a refresh-rotation recovery review?"
  ],
  "supported_claims": [
    {
      "claim": "The rotation documentation describes invalidation of a refresh-token family when reuse of an invalidated token is detected. The service cannot identify the legitimate actor from that replay alone. Both recovery and access-token lifetime need consideration; rotation is not permission to retry stale credentials indefinitely.",
      "reliance": "DOCUMENTED_CAPABILITY_ONLY"
    }
  ],
  "not_demonstrated_claims": [
    "Verified buyer configuration or effective access rights",
    "Independent execution, completeness or security testing",
    "Vendor certification, legal compliance or guaranteed suitability"
  ],
  "public_summary": "The rotation documentation describes invalidation of a refresh-token family when reuse of an invalidated token is detected. The service cannot identify the legitimate actor from that replay alone. Both recovery and access-token lifetime need consideration; rotation is not permission to retry stale credentials indefinitely.",
  "related_record_ids": [
    "VXI-EXT-PROCUREMENT-TERRAFORM-SENSITIVE-STATE-01-v1",
    "VXI-EXT-PROCUREMENT-PULUMI-SECRET-RUNTIME-01-v1",
    "VXI-EXT-PROCUREMENT-VAULT-STATIC-LEASE-01-v1"
  ],
  "source_review": {
    "source_type": "official_external_documentation",
    "source_title": "Auth0 refresh-token rotation and reuse detection",
    "source_url": "https://auth0.com/docs/secure/tokens/refresh-tokens/refresh-token-rotation",
    "checked_on": "2026-10-14",
    "candidate_record_id": "VXI-EXT-PROCUREMENT-AUTH0-REFRESH-REUSE-01-v1",
    "candidate_record_sha256": "e1c017dab716cc8960d1f545c10a8ee374df14c73733bdd46571bf612adcd384",
    "method": "Primary documentation reviewed for the published bounded statement.",
    "deployment_tested_by_varexis": false,
    "revalidation": "The delivered snapshot preserves the review date shown. Recheck current primary documentation and deployment context before relying on present applicability; payment does not trigger fresh research."
  },
  "answer_policy": {
    "classification": "DOCUMENTED_WITH_DEPLOYMENT_BOUNDARY",
    "bounded_answer": "The rotation documentation describes invalidation of a refresh-token family when reuse of an invalidated token is detected. The service cannot identify the legitimate actor from that replay alone. Both recovery and access-token lifetime need consideration; rotation is not permission to retry stale credentials indefinitely.",
    "required_buyer_context": "Client rotation configuration, token family, retry behaviour and reauthentication path.",
    "missing_evidence": "A broader claim needs evidence matching the intended use. Payment does not upgrade the evidence state."
  },
  "private_boundary": "Raw logs, thresholds, private paths, source code, protected mechanisms and reconstruction-level details are excluded from public and paid delivery.",
  "decision_profile": {
    "schema": "varexis-vendor-evidence-review/1",
    "review_status": "documentation_review_only",
    "checked_on": "2026-10-14",
    "claim_to_check": "Automatic rotation makes stale-token retries harmless and preserves uninterrupted access.",
    "documented_statement": {
      "status": "documented",
      "statement": "The rotation documentation describes invalidation of a refresh-token family when reuse of an invalidated token is detected. The service cannot identify the legitimate actor from that replay alone. Both recovery and access-token lifetime need consideration; rotation is not permission to retry stale credentials indefinitely.",
      "source_ids": [
        "auth0-rotation"
      ]
    },
    "buyer_evidence_required": [
      "Client rotation and retry configuration.",
      "Documented handling of reuse events and token-family invalidation.",
      "Reauthentication flow and separate access-token lifecycle evidence."
    ],
    "review_condition": {
      "status": "varexis_review_policy",
      "statement": "Require recovery evidence before accepting uninterrupted-session claims."
    },
    "unknowns": "The buyer configuration, contract, effective entitlement and operational evidence have not been inspected. Missing evidence does not establish absence or failure of the feature.",
    "evidence_sources": [
      {
        "source_id": "auth0-rotation",
        "url": "https://auth0.com/docs/secure/tokens/refresh-tokens/refresh-token-rotation",
        "final_url": "https://auth0.com/docs/secure/tokens/refresh-tokens/refresh-token-rotation",
        "title": "Auth0 refresh-token rotation and reuse detection",
        "checked_on": "2026-10-14",
        "sha256": "ab2c394a06889b29932707b45dfba198025525d7143371c103a59a0935be0915",
        "bytes": 2811179
      }
    ],
    "observed_deployment": false,
    "commercial_reliance_boundary": "Procurement evidence support only; no supplier clearance, legal conclusion, configuration audit or verification of the buyer's claim is supplied.",
    "paid_value": {
      "decision_context": "Preserve the distinction between reuse protection and successful session recovery.",
      "free": "Complete review, practical questions, sources and limitations; may be saved locally.",
      "single_request": "Existing server-saved version-bound route snapshot for later authenticated retrieval.",
      "evidence_receipt": "The same snapshot plus the existing unsigned delivery receipt.",
      "excluded": [
        "Fresh vendor research",
        "Continuous monitoring or change alerts",
        "Testing the buyer configuration",
        "Private evidence or vendor certification"
      ],
      "integrity": "Hashes identify content versions; they do not prove truth or provide a signature."
    },
    "revalidation": {
      "trigger": "A saved purchase does not recheck the source or buyer configuration.",
      "specific_watch": "Rotation policy, client concurrency/retry behaviour and recovery flow."
    }
  },
  "paid_access_note": "The full published answer and boundaries are free. Paid access saves the selected route and source versions, with an unsigned receipt when purchased. Preview coverage before paying. Fresh research, bespoke assessment and protected evidence are excluded.",
  "service_route": {
    "request_guide": "/varexis-index/request.html",
    "request_workflow": "/varexis-index/request-workflow.json",
    "service_id": "single_request",
    "service_routes_url": "/varexis-index/service-routes.json",
    "payment_required": true,
    "availability_endpoint": "/api/index/capabilities",
    "operational_status": "AUTOMATIC_SERVICE_CAPABILITIES_GATED",
    "checkout_url": "/index-access"
  },
  "authority_boundary": "VAREXIS-INDEX informs evidence reliance. It does not provide advice, certification, deployment authority, security assurance, production approval, or guarantee.",
  "human_page": "/varexis-index/catalog.html#auth0-refresh-reuse-family-boundary",
  "machine_readable_record": "/varexis-index/records/auth0-refresh-reuse-family-boundary.json"
}