COconductorone
Cross-App Access

Create

Changed on

Register a resource server (a third-party authorization server) as a permitted cross-app-access audience for an application. The audience must be unique within the application and must not equal your own tenant's issuer — C1 cannot be both the granting IdP and the resource server in the same flow.

post/api/v1/apps/{app_id}/xaa/resource_servers

Request

  • Base URL
    https://example.conductor.one
  • URL
    https://example.conductor.one/api/v1/apps/{app_id}/xaa/resource_servers
  • Auth
    HTTP bearer and OAuth 2
    Client credentials
    Token URL: /auth/v1/token

Path parameters

app_idstring required

The application this resource server fronts.

Request body

descriptionstring

Description of the resource server.

disabledboolean

When true, the resource server is registered but exchange requests are rejected.

displayNamestring

Display name for the resource server.

maxGrantLifetimestring duration nullable
normalizedAudiencestring

The resource authorization server's issuer identifier. Must not equal your own tenant's issuer. Normalized and immutable after creation.

requireProofOfPossessionboolean

When true, mint proof-of-possession-bound grants.

resourceUrisstring[] nullable

Resource identifiers this server governs (RFC 8707).

signingAlgorithm'XAA_SIGNING_ALGORITHM_UNSPECIFIED' | 'XAA_SIGNING_ALGORITHM_EDDSA' | 'XAA_SIGNING_ALGORITHM_RS256' | 'XAA_SIGNING_ALGORITHM_ES256'

JWS algorithm for grants minted for this server. UNSPECIFIED uses the tenant default.

Response

XAAResourceServerServiceCreateResponse returns the registered resource server.

Changes