> ## Documentation Index
> Fetch the complete documentation index at: https://conductorone-muhammad-kumail-native-mcp-tabs-batch.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Update

> Update the tenant's cross-app-access settings. Supply the settings object
 and an update mask listing the fields to change; only masked fields are
 applied. Editable paths: enabled, default_grant_lifetime,
 allow_refresh_token_subjects, default_signing_algorithm,
 enabled_signing_algorithms, xaa_id_token_lifetime.



## OpenAPI

````yaml https://spec.speakeasy.com/conductor-one/conductorone/my-source-with-code-samples post /api/v1/settings/cross-app-access
openapi: 3.1.0
info:
  description: The C1 API is a HTTP API for managing C1 resources.
  title: C1 API
  version: 0.1.0-alpha
servers:
  - description: The C1 API server for the current tenant.
    url: https://{tenantDomain}.conductor.one
    variables:
      tenantDomain:
        default: example
        description: The domain of the tenant to use for this request.
security:
  - bearerAuth: []
    oauth: []
paths:
  /api/v1/settings/cross-app-access:
    post:
      tags:
        - Cross-App Access
      summary: Update
      description: >-
        Update the tenant's cross-app-access settings. Supply the settings
        object
         and an update mask listing the fields to change; only masked fields are
         applied. Editable paths: enabled, default_grant_lifetime,
         allow_refresh_token_subjects, default_signing_algorithm,
         enabled_signing_algorithms, xaa_id_token_lifetime.
      operationId: c1.api.cross_app_access.v1.XAASettingsService.Update
      requestBody:
        content:
          application/json:
            schema:
              $ref: >-
                #/components/schemas/c1.api.cross_app_access.v1.XAASettingsServiceUpdateRequest
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: >-
                  #/components/schemas/c1.api.cross_app_access.v1.XAASettingsServiceUpdateResponse
          description: XAASettingsServiceUpdateResponse returns the updated settings.
      x-codeSamples:
        - lang: go
          label: Update
          source: "package main\n\nimport(\n\t\"context\"\n\t\"github.com/conductorone/conductorone-sdk-go/pkg/models/shared\"\n\tconductoronesdkgo \"github.com/conductorone/conductorone-sdk-go\"\n\t\"log\"\n)\n\nfunc main() {\n    ctx := context.Background()\n\n    s := conductoronesdkgo.New(\n        conductoronesdkgo.WithSecurity(shared.Security{\n            BearerAuth: \"<YOUR_BEARER_TOKEN_HERE>\",\n            Oauth: \"<YOUR_OAUTH_HERE>\",\n        }),\n    )\n\n    res, err := s.XAASettings.Update(ctx, nil)\n    if err != nil {\n        log.Fatal(err)\n    }\n    if res.XAASettingsServiceUpdateResponse != nil {\n        // handle response\n    }\n}"
components:
  schemas:
    c1.api.cross_app_access.v1.XAASettingsServiceUpdateRequest:
      description: |-
        XAASettingsServiceUpdateRequest updates the tenant's cross-app-access
         settings.
      properties:
        settings:
          oneOf:
            - $ref: '#/components/schemas/c1.api.cross_app_access.v1.XAASettings'
            - type: 'null'
        updateMask:
          type:
            - string
            - 'null'
      title: Xaa Settings Service Update Request
      type: object
      x-speakeasy-name-override: XAASettingsServiceUpdateRequest
    c1.api.cross_app_access.v1.XAASettingsServiceUpdateResponse:
      description: XAASettingsServiceUpdateResponse returns the updated settings.
      properties:
        settings:
          oneOf:
            - $ref: '#/components/schemas/c1.api.cross_app_access.v1.XAASettings'
            - type: 'null'
      title: Xaa Settings Service Update Response
      type: object
      x-speakeasy-name-override: XAASettingsServiceUpdateResponse
    c1.api.cross_app_access.v1.XAASettings:
      description: XAASettings is the per-tenant cross-app-access issuer configuration.
      properties:
        allowRefreshTokenSubjects:
          description: >-
            When true, accept refresh tokens as the exchange subject. Must
            remain false
             until that path ships.
          type: boolean
        createdAt:
          format: date-time
          type:
            - string
            - 'null'
        defaultGrantLifetime:
          format: duration
          type:
            - string
            - 'null'
        defaultSigningAlgorithm:
          description: Tenant-default signing algorithm. UNSPECIFIED resolves to ES256.
          enum:
            - XAA_SIGNING_ALGORITHM_UNSPECIFIED
            - XAA_SIGNING_ALGORITHM_EDDSA
            - XAA_SIGNING_ALGORITHM_RS256
            - XAA_SIGNING_ALGORITHM_ES256
          type: string
          x-speakeasy-unknown-values: allow
        enabled:
          description: >-
            Master switch for the cross-app-access issuer and its published
            metadata.
             C1 also gates the feature behind an operator-controlled rollout flag; this
             is the tenant administrator's intent.
          type: boolean
        enabledSigningAlgorithms:
          description: >-
            Algorithms this tenant maintains signing-key families for. EdDSA is
            always
             implicitly present.
          items:
            enum:
              - XAA_SIGNING_ALGORITHM_UNSPECIFIED
              - XAA_SIGNING_ALGORITHM_EDDSA
              - XAA_SIGNING_ALGORITHM_RS256
              - XAA_SIGNING_ALGORITHM_ES256
            type: string
            x-speakeasy-unknown-values: allow
          type:
            - array
            - 'null'
        updatedAt:
          format: date-time
          type:
            - string
            - 'null'
        xaaIdTokenLifetime:
          format: duration
          type:
            - string
            - 'null'
      title: Xaa Settings
      type: object
      x-speakeasy-name-override: XAASettings
  securitySchemes:
    bearerAuth:
      scheme: bearer
      type: http
    oauth:
      description: >-
        This API uses OAuth2 with the Client Credential flow.

        Client Credentials must be sent in the BODY, not the headers.

        For an example of how to implement this, refer to the
        [c1TokenSource.Token()](https://github.com/ConductorOne/conductorone-sdk-go/blob/3375fe7c0126d17e7ec4e711693dee7b791023aa/token_source.go#L101-L187)
        function.
      flows:
        clientCredentials:
          scopes: {}
          tokenUrl: /auth/v1/token
      type: oauth2

````