Update user doc

docs/user-guide.rst

@@ -429,24 +429,31 @@ These are all required fields for an error response. The code and
 message fields will be used by the library as part of the thrown
 exception.
 
-Response format fields summary: ``version``: The version of the JSON
-output. Currently only version 1 is supported. ``success``: The
-status of the response. When true, the response must contain the 3rd
-party token, token type, and expiration. The executable must also exit
-with exit code 0. When false, the response must contain the error code
-and message fields and exit with a non-zero value. ``token_type``:
-The 3rd party subject token type. Must be
-*urn:ietf:params:oauth:token-type:jwt*,
-*urn:ietf:params:oauth:token-type:id_token*, or
-*urn:ietf:params:oauth:token-type:saml2*. ``id_token``: The 3rd party
-OIDC token. ``saml_response``: The 3rd party SAML response. 
-``expiration_time``: The 3rd party subject token expiration time in
-seconds (unix epoch time). ``code``: The error code string. 
-``message``: The error message.
-
-All response types must include both the ``version`` and ``success``
-fields. Successful responses must include the ``token_type``,
-``expiration_time``, and one of ``id_token`` or ``saml_response``. 
+Response format fields summary:
+
+- ``version``: The version of the JSON output. Currently only version 1 is
+  supported.
+- ``success``: The status of the response.
+    - When true, the response must contain the 3rd party token, token type,
+    and expiration. The executable must also exit with exit code 0.
+    - When false, the response must contain the error code and message
+    fields and exit with a non-zero value.
+- ``token_type``: The 3rd party subject token type. Must be
+    - *urn:ietf:params:oauth:token-type:jwt*
+    - *urn:ietf:params:oauth:token-type:id_token*
+    - *urn:ietf:params:oauth:token-type:saml2*
+- ``id_token``: The 3rd party OIDC token.
+- ``saml_response``: The 3rd party SAML response.
+- ``expiration_time``: The 3rd party subject token expiration time in seconds
+  (unix epoch time).
+- ``code``: The error code string.
+- ``message``: The error message.
+
+All response types must include both the ``version`` and ``success`` fields.
+Successful responses must include the ``token_type``, and one of ``id_token``
+or ``saml_response``.
+``expiration_time`` is only optional when ``output_file`` is not specified.
+Otherwise we will treat the response as malformed.
 Error responses must include both the ``code`` and ``message`` fields.
 
 The library will populate the following environment variables when the