---
title: "Create"
method: POST
path: "/api/v1/apps/{app_id}/xaa/resource_servers"
tags: ["Cross-App Access"]
---

# Create

`POST /api/v1/apps/{app_id}/xaa/resource_servers`

Register a resource server (a third-party authorization server) as a
 permitted cross-app-access audience for an application. The audience must
 be unique within the application and must not equal your own tenant's
 issuer — C1 cannot be both the granting IdP and the resource server in the
 same flow.

## Path parameters

- `app_id` string, required — The application this resource server fronts.

## Request body

- C1ApiCrossAppAccessV1XAAResourceServerServiceCreateRequestInput — XAAResourceServerServiceCreateRequest registers a new resource server.
  - `description` string — Description of the resource server.
  - `disabled` boolean — When true, the resource server is registered but exchange requests are rejected.
  - `displayName` string — Display name for the resource server.
  - `maxGrantLifetime` string, duration, nullable
  - `modifyClaimsHook` C1ApiCrossAppAccessV1XAAModifyClaimsHook — XAAModifyClaimsHook registers a tenant Function invoked just before a grant is signed. The function may deny issuance or narrow the outgoing claims. It always runs blocking and fails closed: any error, timeout, or invalid result denies the grant.
    - `commitId` string — Pin to a specific commit of the function. Empty uses the function's published commit, resolved when the resource server is saved.
    - `disabled` boolean — When true, the hook is configured but not invoked.
    - `functionId` string — The Function to invoke.
  - `normalizedAudience` string — The resource authorization server's issuer identifier. Must not equal your own tenant's issuer. Normalized and immutable after creation.
  - `requireProofOfPossession` boolean — When true, mint proof-of-possession-bound grants.
  - `resourceUris` string[], nullable — Resource identifiers this server governs (RFC 8707).
  - `signingAlgorithm` 'XAA_SIGNING_ALGORITHM_UNSPECIFIED' | 'XAA_SIGNING_ALGORITHM_EDDSA' | 'XAA_SIGNING_ALGORITHM_RS256' | 'XAA_SIGNING_ALGORITHM_ES256' — JWS algorithm for grants minted for this server. UNSPECIFIED uses the tenant default.

## Response `200`

XAAResourceServerServiceCreateResponse returns the registered resource server.

- C1ApiCrossAppAccessV1XAAResourceServerServiceCreateResponse — XAAResourceServerServiceCreateResponse returns the registered resource server.
  - `resourceServer` C1ApiCrossAppAccessV1XAAResourceServer — XAAResourceServer is a third-party authorization server registered as a permitted cross-app-access audience for one application.
    - `appId` string — The application this resource server fronts.
    - `createdAt` string, date-time, nullable
    - `deletedAt` string, date-time, nullable
    - `description` string — Description of the resource server.
    - `disabled` boolean — When true, exchange requests for this resource server are rejected without removing the registration (a kill switch).
    - `displayName` string — Display name for the resource server.
    - `id` string — Unique identifier for this resource server.
    - `maxGrantLifetime` string, duration, nullable
    - `modifyClaimsHook` C1ApiCrossAppAccessV1XAAModifyClaimsHook — XAAModifyClaimsHook registers a tenant Function invoked just before a grant is signed. The function may deny issuance or narrow the outgoing claims. It always runs blocking and fails closed: any error, timeout, or invalid result denies the grant.
      - `commitId` string — Pin to a specific commit of the function. Empty uses the function's published commit, resolved when the resource server is saved.
      - `disabled` boolean — When true, the hook is configured but not invoked.
      - `functionId` string — The Function to invoke.
    - `normalizedAudience` string — The resource authorization server's issuer identifier (RFC 8414). Becomes the audience of every grant minted for this server. Stored normalized: lowercase scheme and host, no trailing slash, https only. Immutable after creation. Must not equal your own tenant's issuer.
    - `requireProofOfPossession` boolean — When true, mint proof-of-possession-bound grants for clients presenting a DPoP proof.
    - `resourceUris` string[], nullable — The resource identifiers this server governs (RFC 8707). An allowlist for the token-exchange resource parameter; empty rejects any request that carries a resource parameter.
    - `sectorId` string — Optional pairwise sector override. Empty means the resource server's audience is its own sector. Set to the well-known global sentinel sector to opt into a correlatable shared `sub`, or to a shared value to share one pairwise `sub` across a trust group of audiences. Immutable once set.
    - `signingAlgorithm` 'XAA_SIGNING_ALGORITHM_UNSPECIFIED' | 'XAA_SIGNING_ALGORITHM_EDDSA' | 'XAA_SIGNING_ALGORITHM_RS256' | 'XAA_SIGNING_ALGORITHM_ES256' — JWS algorithm for grants minted for this server. UNSPECIFIED uses the tenant default. Minting fails if no active signing key exists for the resolved algorithm.
    - `updatedAt` string, date-time, nullable

---

[API](https://skmtc.net/conductorone/apis/c1-api.md) · [All operations](https://skmtc.net/conductorone/apis/c1-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/conductorone/c1-api/revisions/f2cf3228f366/schema)