> ## Documentation Index > Fetch the complete documentation index at: https://conductorone-leet-slack-mcp-docs.mintlify.site/llms.txt > Use this file to discover all available pages before exploring further. # List > List the resource servers registered for an application, one page at a time. ## OpenAPI ````yaml https://spec.speakeasy.com/conductor-one/conductorone/my-source-with-code-samples get /api/v1/apps/{app_id}/xaa/resource_servers openapi: 3.1.0 info: description: The C1 API is a HTTP API for managing C1 resources. title: C1 API version: 0.1.0-alpha servers: - description: The C1 API server for the current tenant. url: https://{tenantDomain}.conductor.one variables: tenantDomain: default: example description: The domain of the tenant to use for this request. security: - bearerAuth: [] oauth: [] paths: /api/v1/apps/{app_id}/xaa/resource_servers: get: tags: - Cross-App Access summary: List description: >- List the resource servers registered for an application, one page at a time. operationId: c1.api.cross_app_access.v1.XAAResourceServerService.List parameters: - in: path name: app_id required: true schema: description: The application to list resource servers for. type: string - in: query name: page_size schema: description: Page size (max 100). format: int32 type: integer - in: query name: page_token schema: description: Page token for pagination. type: string responses: '200': content: application/json: schema: $ref: >- #/components/schemas/c1.api.cross_app_access.v1.XAAResourceServerServiceListResponse description: >- XAAResourceServerServiceListResponse returns a page of resource servers. x-codeSamples: - lang: go label: List source: "package main\n\nimport(\n\t\"context\"\n\t\"github.com/conductorone/conductorone-sdk-go/pkg/models/shared\"\n\tconductoronesdkgo \"github.com/conductorone/conductorone-sdk-go\"\n\t\"github.com/conductorone/conductorone-sdk-go/pkg/models/operations\"\n\t\"log\"\n)\n\nfunc main() {\n ctx := context.Background()\n\n s := conductoronesdkgo.New(\n conductoronesdkgo.WithSecurity(shared.Security{\n BearerAuth: \"\",\n Oauth: \"\",\n }),\n )\n\n res, err := s.XAAResourceServer.List(ctx, operations.C1APICrossAppAccessV1XAAResourceServerServiceListRequest{\n AppID: \"\",\n })\n if err != nil {\n log.Fatal(err)\n }\n if res.XAAResourceServerServiceListResponse != nil {\n // handle response\n }\n}" components: schemas: c1.api.cross_app_access.v1.XAAResourceServerServiceListResponse: description: XAAResourceServerServiceListResponse returns a page of resource servers. properties: nextPageToken: description: Token for the next page, or empty if there are no more results. type: string resourceServers: description: The page of resource servers. items: $ref: '#/components/schemas/c1.api.cross_app_access.v1.XAAResourceServer' type: - array - 'null' title: Xaa Resource Server Service List Response type: object x-speakeasy-name-override: XAAResourceServerServiceListResponse c1.api.cross_app_access.v1.XAAResourceServer: description: |- XAAResourceServer is a third-party authorization server registered as a permitted cross-app-access audience for one application. properties: appId: description: The application this resource server fronts. type: string createdAt: format: date-time type: - string - 'null' deletedAt: format: date-time type: - string - 'null' description: description: Description of the resource server. type: string disabled: description: >- When true, exchange requests for this resource server are rejected without removing the registration (a kill switch). type: boolean displayName: description: Display name for the resource server. type: string id: description: Unique identifier for this resource server. type: string maxGrantLifetime: format: duration type: - string - 'null' modifyClaimsHook: oneOf: - $ref: >- #/components/schemas/c1.api.cross_app_access.v1.XAAModifyClaimsHook - type: 'null' normalizedAudience: description: >- The resource authorization server's issuer identifier (RFC 8414). Becomes the audience of every grant minted for this server. Stored normalized: lowercase scheme and host, no trailing slash, https only. Immutable after creation. Must not equal your own tenant's issuer. type: string requireProofOfPossession: description: >- When true, mint proof-of-possession-bound grants for clients presenting a DPoP proof. type: boolean resourceUris: description: >- The resource identifiers this server governs (RFC 8707). An allowlist for the token-exchange resource parameter; empty rejects any request that carries a resource parameter. items: type: string type: - array - 'null' sectorId: description: |- Optional pairwise sector override. Empty means the resource server's audience is its own sector. Set to the well-known global sentinel sector to opt into a correlatable shared `sub`, or to a shared value to share one pairwise `sub` across a trust group of audiences. Immutable once set. type: string signingAlgorithm: description: >- JWS algorithm for grants minted for this server. UNSPECIFIED uses the tenant default. Minting fails if no active signing key exists for the resolved algorithm. enum: - XAA_SIGNING_ALGORITHM_UNSPECIFIED - XAA_SIGNING_ALGORITHM_EDDSA - XAA_SIGNING_ALGORITHM_RS256 - XAA_SIGNING_ALGORITHM_ES256 type: string x-speakeasy-unknown-values: allow updatedAt: format: date-time type: - string - 'null' title: Xaa Resource Server type: object x-speakeasy-name-override: XAAResourceServer c1.api.cross_app_access.v1.XAAModifyClaimsHook: description: >- XAAModifyClaimsHook registers a tenant Function invoked just before a grant is signed. The function may deny issuance or narrow the outgoing claims. It always runs blocking and fails closed: any error, timeout, or invalid result denies the grant. properties: commitId: description: |- Pin to a specific commit of the function. Empty uses the function's published commit, resolved when the resource server is saved. type: string disabled: description: When true, the hook is configured but not invoked. type: boolean functionId: description: The Function to invoke. type: string title: Xaa Modify Claims Hook type: object x-speakeasy-name-override: XAAModifyClaimsHook securitySchemes: bearerAuth: scheme: bearer type: http oauth: description: >- This API uses OAuth2 with the Client Credential flow. Client Credentials must be sent in the BODY, not the headers. For an example of how to implement this, refer to the [c1TokenSource.Token()](https://github.com/ConductorOne/conductorone-sdk-go/blob/3375fe7c0126d17e7ec4e711693dee7b791023aa/token_source.go#L101-L187) function. flows: clientCredentials: scopes: {} tokenUrl: /auth/v1/token type: oauth2 ````