---
title: "List"
method: GET
path: "/api/v1/apps/{app_id}/xaa/resource_servers"
tags: ["Cross-App Access"]
---

# List

`GET /api/v1/apps/{app_id}/xaa/resource_servers`

List the resource servers registered for an application, one page at a time.

## Path parameters

- `app_id` string, required — The application to list resource servers for.

## Query parameters

- `page_size` integer — Page size (max 100).
- `page_token` string — Page token for pagination.

## Response `200`

XAAResourceServerServiceListResponse returns a page of resource servers.

- C1ApiCrossAppAccessV1XAAResourceServerServiceListResponse — XAAResourceServerServiceListResponse returns a page of resource servers.
  - `nextPageToken` string — Token for the next page, or empty if there are no more results.
  - `resourceServers` C1ApiCrossAppAccessV1XAAResourceServer[], nullable — The page of resource servers.
    - `appId` string — The application this resource server fronts.
    - `createdAt` string, date-time, nullable
    - `deletedAt` string, date-time, nullable
    - `description` string — Description of the resource server.
    - `disabled` boolean — When true, exchange requests for this resource server are rejected without removing the registration (a kill switch).
    - `displayName` string — Display name for the resource server.
    - `id` string — Unique identifier for this resource server.
    - `maxGrantLifetime` string, duration, nullable
    - `modifyClaimsHook` C1ApiCrossAppAccessV1XAAModifyClaimsHook — XAAModifyClaimsHook registers a tenant Function invoked just before a grant is signed. The function may deny issuance or narrow the outgoing claims. It always runs blocking and fails closed: any error, timeout, or invalid result denies the grant.
      - `commitId` string — Pin to a specific commit of the function. Empty uses the function's published commit, resolved when the resource server is saved.
      - `disabled` boolean — When true, the hook is configured but not invoked.
      - `functionId` string — The Function to invoke.
    - `normalizedAudience` string — The resource authorization server's issuer identifier (RFC 8414). Becomes the audience of every grant minted for this server. Stored normalized: lowercase scheme and host, no trailing slash, https only. Immutable after creation. Must not equal your own tenant's issuer.
    - `requireProofOfPossession` boolean — When true, mint proof-of-possession-bound grants for clients presenting a DPoP proof.
    - `resourceUris` string[], nullable — The resource identifiers this server governs (RFC 8707). An allowlist for the token-exchange resource parameter; empty rejects any request that carries a resource parameter.
    - `sectorId` string — Optional pairwise sector override. Empty means the resource server's audience is its own sector. Set to the well-known global sentinel sector to opt into a correlatable shared `sub`, or to a shared value to share one pairwise `sub` across a trust group of audiences. Immutable once set.
    - `signingAlgorithm` 'XAA_SIGNING_ALGORITHM_UNSPECIFIED' | 'XAA_SIGNING_ALGORITHM_EDDSA' | 'XAA_SIGNING_ALGORITHM_RS256' | 'XAA_SIGNING_ALGORITHM_ES256' — JWS algorithm for grants minted for this server. UNSPECIFIED uses the tenant default. Minting fails if no active signing key exists for the resolved algorithm.
    - `updatedAt` string, date-time, nullable

---

[API](https://skmtc.net/conductorone/apis/c1-api.md) · [All operations](https://skmtc.net/conductorone/apis/c1-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/conductorone/c1-api/revisions/f2cf3228f366/schema)