> ## Documentation Index > Fetch the complete documentation index at: https://conductorone-leet-slack-mcp-docs.mintlify.site/llms.txt > Use this file to discover all available pages before exploring further. # Update > Update a scope's editable fields via update_mask. This is how a scope is approved: set state to ENABLED to make it mintable, or DISABLED to block it. The scope value is immutable. Editable paths: display_name, description, state, classification. ## OpenAPI ````yaml https://spec.speakeasy.com/conductor-one/conductorone/my-source-with-code-samples post /api/v1/apps/{app_id}/xaa/scopes/{id} openapi: 3.1.0 info: description: The C1 API is a HTTP API for managing C1 resources. title: C1 API version: 0.1.0-alpha servers: - description: The C1 API server for the current tenant. url: https://{tenantDomain}.conductor.one variables: tenantDomain: default: example description: The domain of the tenant to use for this request. security: - bearerAuth: [] oauth: [] paths: /api/v1/apps/{app_id}/xaa/scopes/{id}: post: tags: - Cross-App Access summary: Update description: |- Update a scope's editable fields via update_mask. This is how a scope is approved: set state to ENABLED to make it mintable, or DISABLED to block it. The scope value is immutable. Editable paths: display_name, description, state, classification. operationId: c1.api.cross_app_access.v1.XAAScopeService.Update parameters: - in: path name: app_id required: true schema: description: The application that owns the resource server. type: string - in: path name: id required: true schema: description: Unique identifier for this scope. type: string requestBody: content: application/json: schema: $ref: >- #/components/schemas/c1.api.cross_app_access.v1.XAAScopeServiceUpdateRequestInput responses: '200': content: application/json: schema: $ref: >- #/components/schemas/c1.api.cross_app_access.v1.XAAScopeServiceUpdateResponse description: XAAScopeServiceUpdateResponse returns the updated scope. x-codeSamples: - lang: go label: Update source: "package main\n\nimport(\n\t\"context\"\n\t\"github.com/conductorone/conductorone-sdk-go/pkg/models/shared\"\n\tconductoronesdkgo \"github.com/conductorone/conductorone-sdk-go\"\n\t\"github.com/conductorone/conductorone-sdk-go/pkg/models/operations\"\n\t\"log\"\n)\n\nfunc main() {\n ctx := context.Background()\n\n s := conductoronesdkgo.New(\n conductoronesdkgo.WithSecurity(shared.Security{\n BearerAuth: \"\",\n Oauth: \"\",\n }),\n )\n\n res, err := s.XAAScope.Update(ctx, operations.C1APICrossAppAccessV1XAAScopeServiceUpdateRequest{\n AppID: \"\",\n ID: \"\",\n })\n if err != nil {\n log.Fatal(err)\n }\n if res.XAAScopeServiceUpdateResponse != nil {\n // handle response\n }\n}" components: schemas: c1.api.cross_app_access.v1.XAAScopeServiceUpdateRequestInput: description: XAAScopeServiceUpdateRequest updates an existing scope. properties: scope: oneOf: - $ref: '#/components/schemas/c1.api.cross_app_access.v1.XAAScope' - type: 'null' updateMask: type: - string - 'null' title: Xaa Scope Service Update Request type: object x-speakeasy-name-override: XAAScopeServiceUpdateRequest c1.api.cross_app_access.v1.XAAScopeServiceUpdateResponse: description: XAAScopeServiceUpdateResponse returns the updated scope. properties: scope: oneOf: - $ref: '#/components/schemas/c1.api.cross_app_access.v1.XAAScope' - type: 'null' title: Xaa Scope Service Update Response type: object x-speakeasy-name-override: XAAScopeServiceUpdateResponse c1.api.cross_app_access.v1.XAAScope: description: >- XAAScope is a single OAuth scope exposed by a resource server, elevated into a governable object bound to its own entitlement. properties: appEntitlementId: description: The AppEntitlement created for this scope. type: string appId: description: The application that owns the resource server. type: string classification: description: Risk classification. enum: - XAA_SCOPE_CLASSIFICATION_UNSPECIFIED - XAA_SCOPE_CLASSIFICATION_READ - XAA_SCOPE_CLASSIFICATION_WRITE - XAA_SCOPE_CLASSIFICATION_DESTRUCTIVE - XAA_SCOPE_CLASSIFICATION_SENSITIVE - XAA_SCOPE_CLASSIFICATION_DANGEROUS type: string x-speakeasy-unknown-values: allow createdAt: format: date-time type: - string - 'null' deletedAt: format: date-time type: - string - 'null' description: description: Description of what the scope grants. type: string displayName: description: Display name for the scope. type: string id: description: Unique identifier for this scope. type: string lastDiscoveredAt: format: date-time type: - string - 'null' scopeValue: description: >- The literal OAuth scope string minted into the grant. Immutable after creation (RFC 6749 charset, max 256 bytes). type: string source: description: How C1 learned of the scope. enum: - XAA_SCOPE_SOURCE_UNSPECIFIED - XAA_SCOPE_SOURCE_ADMIN_DECLARED - XAA_SCOPE_SOURCE_DISCOVERED type: string x-speakeasy-unknown-values: allow state: description: Approval/lifecycle state. enum: - XAA_SCOPE_STATE_UNSPECIFIED - XAA_SCOPE_STATE_PENDING_REVIEW - XAA_SCOPE_STATE_ENABLED - XAA_SCOPE_STATE_DISABLED - XAA_SCOPE_STATE_REMOVED type: string x-speakeasy-unknown-values: allow updatedAt: format: date-time type: - string - 'null' xaaResourceServerId: description: The resource server this scope belongs to. type: string title: Xaa Scope type: object x-speakeasy-name-override: XAAScope securitySchemes: bearerAuth: scheme: bearer type: http oauth: description: >- This API uses OAuth2 with the Client Credential flow. Client Credentials must be sent in the BODY, not the headers. For an example of how to implement this, refer to the [c1TokenSource.Token()](https://github.com/ConductorOne/conductorone-sdk-go/blob/3375fe7c0126d17e7ec4e711693dee7b791023aa/token_source.go#L101-L187) function. flows: clientCredentials: scopes: {} tokenUrl: /auth/v1/token type: oauth2 ````