---
title: "Update"
method: POST
path: "/api/v1/apps/{app_id}/xaa/scopes/{id}"
tags: ["Cross-App Access"]
---

# Update

`POST /api/v1/apps/{app_id}/xaa/scopes/{id}`

Update a scope's editable fields via update_mask. This is how a scope is
 approved: set state to ENABLED to make it mintable, or DISABLED to block
 it. The scope value is immutable. Editable paths: display_name,
 description, state, classification.

## Path parameters

- `app_id` string, required — The application that owns the resource server.
- `id` string, required — Unique identifier for this scope.

## Request body

- C1ApiCrossAppAccessV1XAAScopeServiceUpdateRequestInput — XAAScopeServiceUpdateRequest updates an existing scope.
  - `scope` C1ApiCrossAppAccessV1XAAScope — XAAScope is a single OAuth scope exposed by a resource server, elevated into a governable object bound to its own entitlement.
    - `appEntitlementId` string — The AppEntitlement created for this scope.
    - `appId` string — The application that owns the resource server.
    - `classification` 'XAA_SCOPE_CLASSIFICATION_UNSPECIFIED' | 'XAA_SCOPE_CLASSIFICATION_READ' | 'XAA_SCOPE_CLASSIFICATION_WRITE' | 'XAA_SCOPE_CLASSIFICATION_DESTRUCTIVE' | 'XAA_SCOPE_CLASSIFICATION_SENSITIVE' | 'XAA_SCOPE_CLASSIFICATION_DANGEROUS' — Risk classification.
    - `createdAt` string, date-time, nullable
    - `deletedAt` string, date-time, nullable
    - `description` string — Description of what the scope grants.
    - `displayName` string — Display name for the scope.
    - `id` string — Unique identifier for this scope.
    - `lastDiscoveredAt` string, date-time, nullable
    - `scopeValue` string — The literal OAuth scope string minted into the grant. Immutable after creation (RFC 6749 charset, max 256 bytes).
    - `source` 'XAA_SCOPE_SOURCE_UNSPECIFIED' | 'XAA_SCOPE_SOURCE_ADMIN_DECLARED' | 'XAA_SCOPE_SOURCE_DISCOVERED' — How C1 learned of the scope.
    - `state` 'XAA_SCOPE_STATE_UNSPECIFIED' | 'XAA_SCOPE_STATE_PENDING_REVIEW' | 'XAA_SCOPE_STATE_ENABLED' | 'XAA_SCOPE_STATE_DISABLED' | 'XAA_SCOPE_STATE_REMOVED' — Approval/lifecycle state.
    - `updatedAt` string, date-time, nullable
    - `xaaResourceServerId` string — The resource server this scope belongs to.
  - `updateMask` string, nullable

## Response `200`

XAAScopeServiceUpdateResponse returns the updated scope.

- C1ApiCrossAppAccessV1XAAScopeServiceUpdateResponse — XAAScopeServiceUpdateResponse returns the updated scope.
  - `scope` C1ApiCrossAppAccessV1XAAScope — XAAScope is a single OAuth scope exposed by a resource server, elevated into a governable object bound to its own entitlement.
    - `appEntitlementId` string — The AppEntitlement created for this scope.
    - `appId` string — The application that owns the resource server.
    - `classification` 'XAA_SCOPE_CLASSIFICATION_UNSPECIFIED' | 'XAA_SCOPE_CLASSIFICATION_READ' | 'XAA_SCOPE_CLASSIFICATION_WRITE' | 'XAA_SCOPE_CLASSIFICATION_DESTRUCTIVE' | 'XAA_SCOPE_CLASSIFICATION_SENSITIVE' | 'XAA_SCOPE_CLASSIFICATION_DANGEROUS' — Risk classification.
    - `createdAt` string, date-time, nullable
    - `deletedAt` string, date-time, nullable
    - `description` string — Description of what the scope grants.
    - `displayName` string — Display name for the scope.
    - `id` string — Unique identifier for this scope.
    - `lastDiscoveredAt` string, date-time, nullable
    - `scopeValue` string — The literal OAuth scope string minted into the grant. Immutable after creation (RFC 6749 charset, max 256 bytes).
    - `source` 'XAA_SCOPE_SOURCE_UNSPECIFIED' | 'XAA_SCOPE_SOURCE_ADMIN_DECLARED' | 'XAA_SCOPE_SOURCE_DISCOVERED' — How C1 learned of the scope.
    - `state` 'XAA_SCOPE_STATE_UNSPECIFIED' | 'XAA_SCOPE_STATE_PENDING_REVIEW' | 'XAA_SCOPE_STATE_ENABLED' | 'XAA_SCOPE_STATE_DISABLED' | 'XAA_SCOPE_STATE_REMOVED' — Approval/lifecycle state.
    - `updatedAt` string, date-time, nullable
    - `xaaResourceServerId` string — The resource server this scope belongs to.

---

[API](https://skmtc.net/conductorone/apis/c1-api.md) · [All operations](https://skmtc.net/conductorone/apis/c1-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/conductorone/c1-api/revisions/f2cf3228f366/schema)