We are in the process of implementing CIS2 for user-restricted APIs using the combined security pattern. One thing we are now considering is whether we need to add support for back channel logout.
Looking at the documentation for back channel logout linked here User-restricted RESTful APIs - CIS2 combined authentication and authorisation - NHS England Digital in the combined security pattern implementation steps, the validation of the logout token requires checking values against the id token received upon exchanging the authorisation code for the access token. The response from the token request in the combined security pattern though does not include that id token. Is there an alternate way to validate the logout token through the combined security pattern or is handing back channel logout not possible?