---
title: "Create a New Resource Server"
method: POST
path: "/v1/tenants/{tenant_id}/realms/{realm_id}/resource-servers"
tags: ["Resource Servers"]
---

# Create a New Resource Server

`POST /v1/tenants/{tenant_id}/realms/{realm_id}/resource-servers`

## Request

- Base URL: `https://api-us.beyondidentity.com`
- URL: `https://api-us.beyondidentity.com/v1/tenants/{tenant_id}/realms/{realm_id}/resource-servers`
- Auth: HTTP bearer
- TypeScript: <https://skmtc.dev/beyondidentity/apis/beyond-identity-secure-access-api/docs/v1/tenants/:tenant_id/realms/:realm_id/resource-servers/post.ts> (a function with typed inputs; its response is checked against the schema)

To create a resource server, send a POST request to `/v1/tenants/$TENANT_ID/realms/$REALM_ID/resource-servers`. Values in the request body for read-only fields will be ignored.

## Path parameters

- `tenant_id` string, required
- `realm_id` string, required

## Request body

- object: Request for CreateResourceServer.
  - `resource_server` ResourceServer, required: A resource server represents an API server that hosts a set of protected resources and is capable of accepting and responding to protected resource requests using access tokens. Clients can enable these APIs to be consumed from authorized applications.
    - `id` string: A unique identifier for a resource server. This is automatically generated on creation. This field is immutable and read-only. This field is unique within the realm.
    - `realm_id` string: A unique identifier for the resource server's realm. This is automatically set on creation. This field is immutable and read-only.
    - `tenant_id` string: A unique identifier for the resource server's tenant. This is automatically set on creation. This field is immutable and read-only.
    - `display_name` string: A human-readable name for the resource server. This name is used for display purposes.
    - `is_managed` boolean: A boolean indicating whether the resource server is managed by Beyond Identity. Managed resource servers may not be modified by the user. This is automatically set on creation. This field is immutable and read-only.
    - `identifier` string: The identifier of this resource server entity. This value should be unique per realm and is often presented as a URI, as it should be a unique identifier for an API to which access is being gated. This identifier will be returned in the `audience` claim of all tokens minted that provide access to scopes owned by this resource server. The client is responsible for validating tokens are intended for them via this `audience` claim. Tokens minted for the Beyond Identity Management API will use the audience `beyondidentity`, which is reserved and may not be used for any other resource servers.
    - `scopes` string[]: The list of scopes supported by this resource server. For the Beyond Identity Management API, this will include scopes for all publicly available endpoints. Note that applications may not provide access to scopes that are not defined on a resource server that they reference; this is the superset of all allowable application scopes in a given realm.

## Response `200`

The response will be a JSON object containing the standard attributes associated with a resource server.

- ResourceServer: A resource server represents an API server that hosts a set of protected resources and is capable of accepting and responding to protected resource requests using access tokens. Clients can enable these APIs to be consumed from authorized applications.
  - `id` string: A unique identifier for a resource server. This is automatically generated on creation. This field is immutable and read-only. This field is unique within the realm.
  - `realm_id` string: A unique identifier for the resource server's realm. This is automatically set on creation. This field is immutable and read-only.
  - `tenant_id` string: A unique identifier for the resource server's tenant. This is automatically set on creation. This field is immutable and read-only.
  - `display_name` string: A human-readable name for the resource server. This name is used for display purposes.
  - `is_managed` boolean: A boolean indicating whether the resource server is managed by Beyond Identity. Managed resource servers may not be modified by the user. This is automatically set on creation. This field is immutable and read-only.
  - `identifier` string: The identifier of this resource server entity. This value should be unique per realm and is often presented as a URI, as it should be a unique identifier for an API to which access is being gated. This identifier will be returned in the `audience` claim of all tokens minted that provide access to scopes owned by this resource server. The client is responsible for validating tokens are intended for them via this `audience` claim. Tokens minted for the Beyond Identity Management API will use the audience `beyondidentity`, which is reserved and may not be used for any other resource servers.
  - `scopes` string[]: The list of scopes supported by this resource server. For the Beyond Identity Management API, this will include scopes for all publicly available endpoints. Note that applications may not provide access to scopes that are not defined on a resource server that they reference; this is the superset of all allowable application scopes in a given realm.

## Other responses

- `400`: Bad request.
- `401`: Unauthorized.
- `403`: Forbidden.
- `404`: The resource was not found.
- `500`: Server error.

---

[API](https://skmtc.dev/beyondidentity/apis/beyond-identity-secure-access-api.md) - [All operations](https://skmtc.dev/beyondidentity/apis/beyond-identity-secure-access-api/llms.txt) - [OpenAPI document](https://skmtc.dev/beyondidentity/apis/beyond-identity-secure-access-api/revisions/42f3cac49392?raw)