BEbeyondidentity
Resource Servers

Create a New Resource Server

To create a resource server, send a POST request to /v1/tenants/$TENANT_ID/realms/$REALM_ID/resource-servers. Values in the request body for read-only fields will be ignored.

post/v1/tenants/{tenant_id}/realms/{realm_id}/resource-servers

Request

Path parameters

tenant_idstring required
Example:000176d94fd7b4d1

A unique identifier for a tenant.

realm_idstring required
Example:19a95130480dfa79

A unique identifier for a realm.

Request body

Example request

{
  "resource_server": {
    "id": "84db69f5-48a8-4c11-8cda-1bae3a73f07e",
    "realm_id": "caf2ff640497591a",
    "tenant_id": "00011f1183c67b69",
    "display_name": "Pet API",
    "identifier": "https://api.mypetapp.com",
    "scopes": [
      "pets:read"
    ]
  }
}

Response

The response will be a JSON object containing the standard attributes associated with a resource server.

idstring

A unique identifier for a resource server. This is automatically generated on creation. This field is immutable and read-only. This field is unique within the realm.

realm_idstring

A unique identifier for the resource server's realm. This is automatically set on creation. This field is immutable and read-only.

tenant_idstring

A unique identifier for the resource server's tenant. This is automatically set on creation. This field is immutable and read-only.

display_namestring

A human-readable name for the resource server. This name is used for display purposes.

is_managedboolean

A boolean indicating whether the resource server is managed by Beyond Identity. Managed resource servers may not be modified by the user. This is automatically set on creation. This field is immutable and read-only.

identifierstring

The identifier of this resource server entity. This value should be unique per realm and is often presented as a URI, as it should be a unique identifier for an API to which access is being gated. This identifier will be returned in the audience claim of all tokens minted that provide access to scopes owned by this resource server. The client is responsible for validating tokens are intended for them via this audience claim. Tokens minted for the Beyond Identity Management API will use the audience beyondidentity, which is reserved and may not be used for any other resource servers.

scopesstring[]

The list of scopes supported by this resource server. For the Beyond Identity Management API, this will include scopes for all publicly available endpoints. Note that applications may not provide access to scopes that are not defined on a resource server that they reference; this is the superset of all allowable application scopes in a given realm.

Example response

{
  "id": "84db69f5-48a8-4c11-8cda-1bae3a73f07e",
  "realm_id": "caf2ff640497591a",
  "tenant_id": "00011f1183c67b69",
  "display_name": "Pet API",
  "identifier": "https://api.mypetapp.com",
  "scopes": [
    "pets:read"
  ]
}

Changes

No recorded changes to this operation across all 2 revisions of this API.