---
title: "Create"
method: POST
path: "/api/v1/apps/{app_id}/authzen_servers"
tags: ["AuthZEN Servers"]
---

# Create

`POST /api/v1/apps/{app_id}/authzen_servers`

## Request

- Base URL: `https://example.conductor.one`
- URL: `https://example.conductor.one/api/v1/apps/{app_id}/authzen_servers`
- Auth: HTTP bearer and OAuth 2
  - Client credentials
  - Token URL: `/auth/v1/token`

Create mints an AuthZEN server (and its evaluate/search entitlements)
 for an app. The server starts disabled.

## Path parameters

- `app_id` string, required: App identifier.

## Request body

- C1ApiAuthzenV1AuthzenServerServiceCreateRequestInput: AuthzenServerServiceCreateRequest creates an AuthZEN server for an app. The new server starts disabled and denies every PDP call until enabled.
  - `displayName` string: Display name for the server. Defaults to "AuthZEN Server" when empty.

## Response `200`

AuthzenServerServiceCreateResponse returns the newly minted server,
 including its capability entitlement ids.

- C1ApiAuthzenV1AuthzenServerServiceCreateResponse: AuthzenServerServiceCreateResponse returns the newly minted server, including its capability entitlement ids.
  - `authzenServer` C1ApiAuthzenV1AuthzenServer: AuthzenServer is the customer-facing AuthZEN PDP endpoint for one App.
    - `activePolicyId` string: The active immutable policy revision. Empty is default deny.
    - `appId` string: App identifier.
    - `createdAt` string, date-time, nullable
    - `displayName` string: The displayName field.
    - `evaluateEntitlementId` string: The minted "evaluate" entitlement (derived from the server id; returned for linking) -- grant it to a caller to let it POST the access evaluation endpoint.
    - `id` string: The id field.
    - `mode` 'AUTHZEN_MODE_UNSPECIFIED' | 'AUTHZEN_MODE_DISABLED' | 'AUTHZEN_MODE_OBSERVE' | 'AUTHZEN_MODE_ENFORCE': The e-stop, now a tri-state. DISABLED (and UNSPECIFIED) denies every call without touching the entitlement stack or its grants; OBSERVE evaluates fully but answers allow, recording what ENFORCE would have said; ENFORCE answers the policy's decision.
    - `searchEntitlementId` string: The minted "search" entitlement (derived from the server id; returned for linking) -- grant it to a caller to let it POST the subject/resource/action search endpoints.
    - `tokenAudience` string: The `audience` to send when exchanging a token for access to this server. Every AuthZEN deployment in the tenant shares it, so it names the service; `token_resource` names this server.
    - `tokenResource` string: The `resource` to send alongside `token_audience`. It pins the exchange to this server, and the issued grant echoes it back, so send it exactly as given.
    - `tokenScopes` string[], nullable: The scopes this server can issue. An exchange receives the ones it requests that the caller also holds the matching capability entitlement for.
    - `updatedAt` string, date-time, nullable

## Changes

- **2026-10-06** `918a4e749f56`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/conductorone/apis/c1-api/changes/api/v1/apps/:app_id/authzen_servers/post.md)

---

[API](https://skmtc.dev/conductorone/apis/c1-api.md) - [All operations](https://skmtc.dev/conductorone/apis/c1-api/llms.txt) - [OpenAPI document](https://skmtc.dev/conductorone/apis/c1-api/revisions/fe943bedf41b?raw)