# C1 documentation: API Endpoints Cross-App Access ## Cross-App Access - [List](https://www.c1.ai/docs/api-reference/cross-app-access/list.md): List the access profiles defined for an application, one page at a time. - [Create](https://www.c1.ai/docs/api-reference/cross-app-access/create.md): Create an access profile under a resource server. The backend also provisions a backing AppEntitlement that users request to be granted the profile's scopes. - [List](https://www.c1.ai/docs/api-reference/cross-app-access/list-1.md): List the scopes bound to an access profile, one page at a time. - [Create Bindings](https://www.c1.ai/docs/api-reference/cross-app-access/create-bindings.md): CreateBindings binds one or more scopes (xaa_scope_ids) to an access profile. Every scope must belong to the profile's resource server. - [Delete Bindings](https://www.c1.ai/docs/api-reference/cross-app-access/delete-bindings.md): DeleteBindings unbinds one or more scopes (xaa_scope_ids) from an access profile. Uses a POST .../delete action route because the scope IDs travel in the request body, which HTTP DELETE does not reliably support. - [Get](https://www.c1.ai/docs/api-reference/cross-app-access/get.md): Get an access profile by app_id + id. - [Update](https://www.c1.ai/docs/api-reference/cross-app-access/update.md): Update an access profile's editable fields via update_mask. Editable paths: display_name, description. The profile must include id and app_id. - [Delete](https://www.c1.ai/docs/api-reference/cross-app-access/delete.md): Delete an access profile (soft delete). Cascades to its scope bindings and backing entitlement; outstanding grants end with the entitlement. - [List History](https://www.c1.ai/docs/api-reference/cross-app-access/list-history.md): ListHistory returns the change history (newest first) for a single access profile — each entry is a snapshot plus who/when metadata. - [Get By App Entitlement Id](https://www.c1.ai/docs/api-reference/cross-app-access/get-by-app-entitlement-id.md): GetByAppEntitlementId looks up the access profile linked to an entitlement, by app_id + app_entitlement_id. Used by the request catalog. - [List](https://www.c1.ai/docs/api-reference/cross-app-access/list-2.md): List the resource servers registered for an application, one page at a time. - [Create](https://www.c1.ai/docs/api-reference/cross-app-access/create-1.md): Register a resource server (a third-party authorization server) as a permitted cross-app-access audience for an application. The audience must be unique within the application and must not equal your own tenant's issuer — C1 cannot be both the granting IdP and the resource server in the same flo… - [Get](https://www.c1.ai/docs/api-reference/cross-app-access/get-1.md): Get a registered resource server by app_id + id. - [Update](https://www.c1.ai/docs/api-reference/cross-app-access/update-1.md): Update a resource server's editable fields via update_mask. The audience is immutable (delete and recreate to change it); supplying a different audience is rejected. Editable paths: display_name, description, resource_uris, max_grant_lifetime, signing_algorithm, require_proof_of_possession, modi… - [Delete](https://www.c1.ai/docs/api-reference/cross-app-access/delete-1.md): Delete a resource server (soft delete). Cascades to its scopes, access profiles, and client audience mappings. - [List History](https://www.c1.ai/docs/api-reference/cross-app-access/list-history-1.md): ListHistory returns the change history (newest first) for a single resource server — each entry is a snapshot plus who/when metadata. - [List](https://www.c1.ai/docs/api-reference/cross-app-access/list-3.md): List the scopes defined for an application, one page at a time. To filter by resource server, state, or classification, use Search. - [Create](https://www.c1.ai/docs/api-reference/cross-app-access/create-2.md): Declare a scope under a resource server. The scope value is the literal OAuth scope string and is immutable after creation. - [Get](https://www.c1.ai/docs/api-reference/cross-app-access/get-2.md): Get a scope by app_id + id. - [Update](https://www.c1.ai/docs/api-reference/cross-app-access/update-2.md): Update a scope's editable fields via update_mask. This is how a scope is approved: set state to ENABLED to make it mintable, or DISABLED to block it. The scope value is immutable. Editable paths: display_name, description, state, classification. - [Delete](https://www.c1.ai/docs/api-reference/cross-app-access/delete-2.md): Delete a scope (soft delete). Cascades to its backing entitlement and to any access-profile bindings that reference it. - [List History](https://www.c1.ai/docs/api-reference/cross-app-access/list-history-2.md): ListHistory returns the change history (newest first) for a single scope — each entry is a snapshot plus who/when metadata. - [Search](https://www.c1.ai/docs/api-reference/cross-app-access/search.md): Search scope bindings, filtered by access profile or by scope, or fetch a specific set by ref. The by-scope direction answers "which profiles contain this scope" for impact analysis. - [Search](https://www.c1.ai/docs/api-reference/cross-app-access/search-1.md): Search access profiles across the tenant, filtered by application, resource server, or text query, or fetch a specific set by ref. - [Search](https://www.c1.ai/docs/api-reference/cross-app-access/search-2.md): Search client audience mappings across the tenant, filtered by resource server, disabled state, or text query, or fetch a specific set by ref. - [Search](https://www.c1.ai/docs/api-reference/cross-app-access/search-3.md): Search resource servers across the tenant, filtered by application, audience substring, signing algorithm, or disabled state, or fetch a specific set by ref. Returns one page at a time. - [Search](https://www.c1.ai/docs/api-reference/cross-app-access/search-4.md): Search scopes across the tenant, filtered by resource server, state, classification, source, or text query, or fetch a specific set by ref. Filter on PENDING_REVIEW to find scopes awaiting approval. - [Get](https://www.c1.ai/docs/api-reference/cross-app-access/get-3.md): Get the tenant's cross-app-access settings. - [Update](https://www.c1.ai/docs/api-reference/cross-app-access/update-3.md): Update the tenant's cross-app-access settings. Supply the settings object and an update mask listing the fields to change; only masked fields are applied. Editable paths: enabled, default_grant_lifetime, allow_refresh_token_subjects, default_signing_algorithm, enabled_signing_algorithms, xaa_id_… - [List History](https://www.c1.ai/docs/api-reference/cross-app-access/list-history-3.md): List the change history for the tenant's cross-app-access settings (newest first). Singleton: scoped to the caller's tenant. - [Update](https://www.c1.ai/docs/api-reference/cross-app-access/update-4.md): Update a mapping's editable fields via update_mask. The resource server and client key identify the mapping and are immutable. Editable paths: audience_client_id, disabled. - [List](https://www.c1.ai/docs/api-reference/cross-app-access/list-4.md): List the client audience mappings for a resource server, one page at a time. - [Create](https://www.c1.ai/docs/api-reference/cross-app-access/create-3.md): Create a client audience mapping under a resource server. - [Get](https://www.c1.ai/docs/api-reference/cross-app-access/get-4.md): Get a client audience mapping by resource server + client key. The client key is passed as a query parameter because it may be a URL. - [Delete](https://www.c1.ai/docs/api-reference/cross-app-access/delete-3.md): Delete a mapping (soft delete). Uses a POST .../delete action route because the client key travels in the request body, which HTTP DELETE does not reliably support. - [List History](https://www.c1.ai/docs/api-reference/cross-app-access/list-history-4.md): ListHistory returns the change history (newest first) for a single client audience mapping — each entry is a snapshot plus who/when metadata. The client key is passed as a query parameter because it may be a URL. ## OpenAPI Specs - [my-source-with-code-samples](https://spec.speakeasy.com/conductor-one/conductorone/my-source-with-code-samples)