# RuntimeCustomClaim

Represents a custom claim validation configuration for Runtime JWT authorizers.

Custom claims allow you to validate additional fields in JWT tokens beyond
the standard audience, client, and scope validations.

- Source: [`aws-bedrockagentcore/lib/runtime/inbound-auth/custom-claim.ts`](https://github.com/aws/aws-cdk/blob/v2.275.0/packages/aws-cdk-lib/aws-bedrockagentcore/lib/runtime/inbound-auth/custom-claim.ts#L26)
- Type last changed: v2.255.0 · 19 May 2026

## Example

```ts
declare const userPool: cognito.UserPool;
declare const userPoolClient: cognito.UserPoolClient;
declare const anotherUserPoolClient: cognito.UserPoolClient;

const repository = new ecr.Repository(this, "TestRepository", {
  repositoryName: "test-agent-runtime",
});
const agentRuntimeArtifact = agentcore.AgentRuntimeArtifact.fromEcrRepository(repository, "v1.0.0");

// Optional: Create custom claims for additional validation
const customClaims = [
  agentcore.RuntimeCustomClaim.withStringValue('department', 'engineering'),
  agentcore.RuntimeCustomClaim.withStringArrayValue('roles', ['admin'], agentcore.CustomClaimOperator.CONTAINS),
  agentcore.RuntimeCustomClaim.withStringArrayValue('permissions', ['read', 'write'], agentcore.CustomClaimOperator.CONTAINS_ANY),
];

const runtime = new agentcore.Runtime(this, "MyAgentRuntime", {
  runtimeName: "myAgent",
  agentRuntimeArtifact: agentRuntimeArtifact,
  authorizerConfiguration: agentcore.RuntimeAuthorizerConfiguration.usingCognito(
    userPool, // User Pool (required)
    [userPoolClient, anotherUserPoolClient], // User Pool Clients
    ["audience1"], // Allowed Audiences (optional)
    ["read", "write"], // Allowed Scopes (optional)
    customClaims, // Custom claims (optional) - see Custom Claims Validation section
  ),
});
```

## Methods

- `withStringArrayValue(name: string, values: string[], operator?: CustomClaimOperator): RuntimeCustomClaim // chainable` (static) — Create a custom claim with a string array value.

  String array claims can use CONTAINS (default) or CONTAINS_ANY operator.

  **Parameters**

  - `name` — The name of the claim in the JWT token.
  - `values` — The array of string values to match.
  - `operator` — The match operator (defaults to CONTAINS).

  **Returns:** A RuntimeCustomClaim configured for string array validation

- `withStringValue(name: string, value: string): RuntimeCustomClaim // chainable` (static) — Create a custom claim with a string value.

  String claims must use the EQUALS operator.

  **Parameters**

  - `name` — The name of the claim in the JWT token.
  - `value` — The string value to match (must exactly equal).

  **Returns:** A RuntimeCustomClaim configured for string validation