When a websocket session is timed out due to the value set in Session.setMaxIdleTimeout(), the server endpoint is called back (twice) with first a close code of 1001, and then a close code of 1000.

JSR-356 v1.1 section 2.1.5 says that in this specific case, it should use 1006:

If the close was initiated by the local container, for example if the local container determines the session has timed out, the local implementation must use the websocket protocol close code 1006 (a code especially disallowed in close frames on the wire), with a suitable close reason. That way the endpoint can determine whether the close was initiated remotely or locally.