> ## Documentation Index > Fetch the complete documentation index at: https://conductorone-leet-slack-mcp-docs.mintlify.site/llms.txt > Use this file to discover all available pages before exploring further. # Update > Update a resource server's editable fields via update_mask. The audience is immutable (delete and recreate to change it); supplying a different audience is rejected. Editable paths: display_name, description, resource_uris, max_grant_lifetime, signing_algorithm, require_proof_of_possession, modify_claims_hook, disabled. sector_id is immutable once set (delete and recreate to change it). ## OpenAPI ````yaml https://spec.speakeasy.com/conductor-one/conductorone/my-source-with-code-samples post /api/v1/apps/{app_id}/xaa/resource_servers/{id} openapi: 3.1.0 info: description: The C1 API is a HTTP API for managing C1 resources. title: C1 API version: 0.1.0-alpha servers: - description: The C1 API server for the current tenant. url: https://{tenantDomain}.conductor.one variables: tenantDomain: default: example description: The domain of the tenant to use for this request. security: - bearerAuth: [] oauth: [] paths: /api/v1/apps/{app_id}/xaa/resource_servers/{id}: post: tags: - Cross-App Access summary: Update description: |- Update a resource server's editable fields via update_mask. The audience is immutable (delete and recreate to change it); supplying a different audience is rejected. Editable paths: display_name, description, resource_uris, max_grant_lifetime, signing_algorithm, require_proof_of_possession, modify_claims_hook, disabled. sector_id is immutable once set (delete and recreate to change it). operationId: c1.api.cross_app_access.v1.XAAResourceServerService.Update parameters: - in: path name: app_id required: true schema: description: The application this resource server fronts. type: string - in: path name: id required: true schema: description: Unique identifier for this resource server. type: string requestBody: content: application/json: schema: $ref: >- #/components/schemas/c1.api.cross_app_access.v1.XAAResourceServerServiceUpdateRequestInput responses: '200': content: application/json: schema: $ref: >- #/components/schemas/c1.api.cross_app_access.v1.XAAResourceServerServiceUpdateResponse description: >- XAAResourceServerServiceUpdateResponse returns the updated resource server. x-codeSamples: - lang: go label: Update source: "package main\n\nimport(\n\t\"context\"\n\t\"github.com/conductorone/conductorone-sdk-go/pkg/models/shared\"\n\tconductoronesdkgo \"github.com/conductorone/conductorone-sdk-go\"\n\t\"github.com/conductorone/conductorone-sdk-go/pkg/models/operations\"\n\t\"log\"\n)\n\nfunc main() {\n ctx := context.Background()\n\n s := conductoronesdkgo.New(\n conductoronesdkgo.WithSecurity(shared.Security{\n BearerAuth: \"\",\n Oauth: \"\",\n }),\n )\n\n res, err := s.XAAResourceServer.Update(ctx, operations.C1APICrossAppAccessV1XAAResourceServerServiceUpdateRequest{\n AppID: \"\",\n ID: \"\",\n })\n if err != nil {\n log.Fatal(err)\n }\n if res.XAAResourceServerServiceUpdateResponse != nil {\n // handle response\n }\n}" components: schemas: c1.api.cross_app_access.v1.XAAResourceServerServiceUpdateRequestInput: description: >- XAAResourceServerServiceUpdateRequest updates an existing resource server. properties: resourceServer: oneOf: - $ref: >- #/components/schemas/c1.api.cross_app_access.v1.XAAResourceServer - type: 'null' updateMask: type: - string - 'null' title: Xaa Resource Server Service Update Request type: object x-speakeasy-name-override: XAAResourceServerServiceUpdateRequest c1.api.cross_app_access.v1.XAAResourceServerServiceUpdateResponse: description: >- XAAResourceServerServiceUpdateResponse returns the updated resource server. properties: resourceServer: oneOf: - $ref: >- #/components/schemas/c1.api.cross_app_access.v1.XAAResourceServer - type: 'null' title: Xaa Resource Server Service Update Response type: object x-speakeasy-name-override: XAAResourceServerServiceUpdateResponse c1.api.cross_app_access.v1.XAAResourceServer: description: |- XAAResourceServer is a third-party authorization server registered as a permitted cross-app-access audience for one application. properties: appId: description: The application this resource server fronts. type: string createdAt: format: date-time type: - string - 'null' deletedAt: format: date-time type: - string - 'null' description: description: Description of the resource server. type: string disabled: description: >- When true, exchange requests for this resource server are rejected without removing the registration (a kill switch). type: boolean displayName: description: Display name for the resource server. type: string id: description: Unique identifier for this resource server. type: string maxGrantLifetime: format: duration type: - string - 'null' modifyClaimsHook: oneOf: - $ref: >- #/components/schemas/c1.api.cross_app_access.v1.XAAModifyClaimsHook - type: 'null' normalizedAudience: description: >- The resource authorization server's issuer identifier (RFC 8414). Becomes the audience of every grant minted for this server. Stored normalized: lowercase scheme and host, no trailing slash, https only. Immutable after creation. Must not equal your own tenant's issuer. type: string requireProofOfPossession: description: >- When true, mint proof-of-possession-bound grants for clients presenting a DPoP proof. type: boolean resourceUris: description: >- The resource identifiers this server governs (RFC 8707). An allowlist for the token-exchange resource parameter; empty rejects any request that carries a resource parameter. items: type: string type: - array - 'null' sectorId: description: |- Optional pairwise sector override. Empty means the resource server's audience is its own sector. Set to the well-known global sentinel sector to opt into a correlatable shared `sub`, or to a shared value to share one pairwise `sub` across a trust group of audiences. Immutable once set. type: string signingAlgorithm: description: >- JWS algorithm for grants minted for this server. UNSPECIFIED uses the tenant default. Minting fails if no active signing key exists for the resolved algorithm. enum: - XAA_SIGNING_ALGORITHM_UNSPECIFIED - XAA_SIGNING_ALGORITHM_EDDSA - XAA_SIGNING_ALGORITHM_RS256 - XAA_SIGNING_ALGORITHM_ES256 type: string x-speakeasy-unknown-values: allow updatedAt: format: date-time type: - string - 'null' title: Xaa Resource Server type: object x-speakeasy-name-override: XAAResourceServer c1.api.cross_app_access.v1.XAAModifyClaimsHook: description: >- XAAModifyClaimsHook registers a tenant Function invoked just before a grant is signed. The function may deny issuance or narrow the outgoing claims. It always runs blocking and fails closed: any error, timeout, or invalid result denies the grant. properties: commitId: description: |- Pin to a specific commit of the function. Empty uses the function's published commit, resolved when the resource server is saved. type: string disabled: description: When true, the hook is configured but not invoked. type: boolean functionId: description: The Function to invoke. type: string title: Xaa Modify Claims Hook type: object x-speakeasy-name-override: XAAModifyClaimsHook securitySchemes: bearerAuth: scheme: bearer type: http oauth: description: >- This API uses OAuth2 with the Client Credential flow. Client Credentials must be sent in the BODY, not the headers. For an example of how to implement this, refer to the [c1TokenSource.Token()](https://github.com/ConductorOne/conductorone-sdk-go/blob/3375fe7c0126d17e7ec4e711693dee7b791023aa/token_source.go#L101-L187) function. flows: clientCredentials: scopes: {} tokenUrl: /auth/v1/token type: oauth2 ````