---
title: "Update"
method: POST
path: "/api/v1/settings/cross-app-access"
tags: ["Cross-App Access"]
---

# Update

`POST /api/v1/settings/cross-app-access`

Update the tenant's cross-app-access settings. Supply the settings object
 and an update mask listing the fields to change; only masked fields are
 applied. Editable paths: enabled, default_grant_lifetime,
 allow_refresh_token_subjects, default_signing_algorithm,
 enabled_signing_algorithms, xaa_id_token_lifetime.

## Request body

- C1ApiCrossAppAccessV1XAASettingsServiceUpdateRequest — XAASettingsServiceUpdateRequest updates the tenant's cross-app-access settings.
  - `settings` C1ApiCrossAppAccessV1XAASettings — XAASettings is the per-tenant cross-app-access issuer configuration.
    - `allowRefreshTokenSubjects` boolean — When true, accept refresh tokens as the exchange subject. Must remain false until that path ships.
    - `createdAt` string, date-time, nullable
    - `defaultGrantLifetime` string, duration, nullable
    - `defaultSigningAlgorithm` 'XAA_SIGNING_ALGORITHM_UNSPECIFIED' | 'XAA_SIGNING_ALGORITHM_EDDSA' | 'XAA_SIGNING_ALGORITHM_RS256' | 'XAA_SIGNING_ALGORITHM_ES256' — Tenant-default signing algorithm. UNSPECIFIED resolves to ES256.
    - `enabled` boolean — Master switch for the cross-app-access issuer and its published metadata. C1 also gates the feature behind an operator-controlled rollout flag; this is the tenant administrator's intent.
    - `enabledSigningAlgorithms` string[], nullable — Algorithms this tenant maintains signing-key families for. EdDSA is always implicitly present.
    - `updatedAt` string, date-time, nullable
    - `xaaIdTokenLifetime` string, duration, nullable
  - `updateMask` string, nullable

## Response `200`

XAASettingsServiceUpdateResponse returns the updated settings.

- C1ApiCrossAppAccessV1XAASettingsServiceUpdateResponse — XAASettingsServiceUpdateResponse returns the updated settings.
  - `settings` C1ApiCrossAppAccessV1XAASettings — XAASettings is the per-tenant cross-app-access issuer configuration.
    - `allowRefreshTokenSubjects` boolean — When true, accept refresh tokens as the exchange subject. Must remain false until that path ships.
    - `createdAt` string, date-time, nullable
    - `defaultGrantLifetime` string, duration, nullable
    - `defaultSigningAlgorithm` 'XAA_SIGNING_ALGORITHM_UNSPECIFIED' | 'XAA_SIGNING_ALGORITHM_EDDSA' | 'XAA_SIGNING_ALGORITHM_RS256' | 'XAA_SIGNING_ALGORITHM_ES256' — Tenant-default signing algorithm. UNSPECIFIED resolves to ES256.
    - `enabled` boolean — Master switch for the cross-app-access issuer and its published metadata. C1 also gates the feature behind an operator-controlled rollout flag; this is the tenant administrator's intent.
    - `enabledSigningAlgorithms` string[], nullable — Algorithms this tenant maintains signing-key families for. EdDSA is always implicitly present.
    - `updatedAt` string, date-time, nullable
    - `xaaIdTokenLifetime` string, duration, nullable

---

[API](https://skmtc.net/conductorone/apis/c1-api.md) · [All operations](https://skmtc.net/conductorone/apis/c1-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/conductorone/c1-api/revisions/f2cf3228f366/schema)