%% You should probably cite rfc8417 instead of this I-D.
@techreport{ietf-secevent-token-08,
    number =    {draft-ietf-secevent-token-08},
    type =      {Internet-Draft},
    institution =   {Internet Engineering Task Force},
    publisher = {Internet Engineering Task Force},
    note =      {Work in Progress},
    url =       {https://datatracker.ietf.org/doc/draft-ietf-secevent-token/08/},
    author =    {Phil Hunt and Michael B. Jones and William Denniss and Morteza Ansari},
    title =     {{Security Event Token (SET)}},
    pagetotal = 28,
    year =      2018,
    month =     apr,
    day =       5,
    abstract =  {This specification defines the Security Event Token (SET) data structure. A SET describes a statement of fact from the perspective of an issuer about the state of a security subject, which is intended to be shared with one or more recipients. This statement of fact represents an event that occurred to the security subject. This specification is intended to enable representing security- and identity-related events. A SET is a JSON Web Token (JWT), which can be optionally signed and/or encrypted. SETs can be distributed via protocols such as HTTP.},
}