Skip to main content
POST
Create

Authorizations

Authorization
string
header
required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Authorization
string
header
required

This API uses OAuth2 with the Client Credential flow. Client Credentials must be sent in the BODY, not the headers. For an example of how to implement this, refer to the c1TokenSource.Token() function.

Path Parameters

app_id
string
required

The application this resource server fronts.

Body

application/json

XAAResourceServerServiceCreateRequest registers a new resource server.

description
string

Description of the resource server.

disabled
boolean

When true, the resource server is registered but exchange requests are rejected.

displayName
string

Display name for the resource server.

maxGrantLifetime
string<duration> | null
modifyClaimsHook
Xaa Modify Claims Hook · object | null

XAAModifyClaimsHook registers a tenant Function invoked just before a grant is signed. The function may deny issuance or narrow the outgoing claims. It always runs blocking and fails closed: any error, timeout, or invalid result denies the grant.

normalizedAudience
string

The resource authorization server's issuer identifier. Must not equal your own tenant's issuer. Normalized and immutable after creation.

requireProofOfPossession
boolean

When true, mint proof-of-possession-bound grants.

resourceUris
string[] | null

Resource identifiers this server governs (RFC 8707).

signingAlgorithm
enum<string>

JWS algorithm for grants minted for this server. UNSPECIFIED uses the tenant default.

Available options:
XAA_SIGNING_ALGORITHM_UNSPECIFIED,
XAA_SIGNING_ALGORITHM_EDDSA,
XAA_SIGNING_ALGORITHM_RS256,
XAA_SIGNING_ALGORITHM_ES256

Response

200 - application/json

XAAResourceServerServiceCreateResponse returns the registered resource server.

XAAResourceServerServiceCreateResponse returns the registered resource server.

resourceServer
Xaa Resource Server · object | null

XAAResourceServer is a third-party authorization server registered as a permitted cross-app-access audience for one application.