> ## Documentation Index > Fetch the complete documentation index at: https://conductorone-docs-ia-reframe-draft.mintlify.site/llms.txt > Use this file to discover all available pages before exploring further. # Create > Declare a scope under a resource server. The scope value is the literal OAuth scope string and is immutable after creation. ## OpenAPI ````yaml https://spec.speakeasy.com/conductor-one/conductorone/my-source-with-code-samples post /api/v1/apps/{app_id}/xaa/scopes openapi: 3.1.0 info: description: The C1 API is a HTTP API for managing C1 resources. title: C1 API version: 0.1.0-alpha servers: - description: The C1 API server for the current tenant. url: https://{tenantDomain}.conductor.one variables: tenantDomain: default: example description: The domain of the tenant to use for this request. security: - bearerAuth: [] oauth: [] paths: /api/v1/apps/{app_id}/xaa/scopes: post: tags: - Cross-App Access summary: Create description: |- Declare a scope under a resource server. The scope value is the literal OAuth scope string and is immutable after creation. operationId: c1.api.cross_app_access.v1.XAAScopeService.Create parameters: - in: path name: app_id required: true schema: description: The application that owns the resource server. type: string requestBody: content: application/json: schema: $ref: >- #/components/schemas/c1.api.cross_app_access.v1.XAAScopeServiceCreateRequestInput responses: '200': content: application/json: schema: $ref: >- #/components/schemas/c1.api.cross_app_access.v1.XAAScopeServiceCreateResponse description: XAAScopeServiceCreateResponse returns the created scope. x-codeSamples: - lang: go label: Create source: "package main\n\nimport(\n\t\"context\"\n\t\"github.com/conductorone/conductorone-sdk-go/pkg/models/shared\"\n\tconductoronesdkgo \"github.com/conductorone/conductorone-sdk-go\"\n\t\"github.com/conductorone/conductorone-sdk-go/pkg/models/operations\"\n\t\"log\"\n)\n\nfunc main() {\n ctx := context.Background()\n\n s := conductoronesdkgo.New(\n conductoronesdkgo.WithSecurity(shared.Security{\n BearerAuth: \"\",\n Oauth: \"\",\n }),\n )\n\n res, err := s.XAAScope.Create(ctx, operations.C1APICrossAppAccessV1XAAScopeServiceCreateRequest{\n AppID: \"\",\n })\n if err != nil {\n log.Fatal(err)\n }\n if res.XAAScopeServiceCreateResponse != nil {\n // handle response\n }\n}" components: schemas: c1.api.cross_app_access.v1.XAAScopeServiceCreateRequestInput: description: XAAScopeServiceCreateRequest declares a new scope. properties: classification: description: Risk classification. enum: - XAA_SCOPE_CLASSIFICATION_UNSPECIFIED - XAA_SCOPE_CLASSIFICATION_READ - XAA_SCOPE_CLASSIFICATION_WRITE - XAA_SCOPE_CLASSIFICATION_DESTRUCTIVE - XAA_SCOPE_CLASSIFICATION_SENSITIVE - XAA_SCOPE_CLASSIFICATION_DANGEROUS type: string x-speakeasy-unknown-values: allow description: description: Description of what the scope grants. type: string displayName: description: Display name for the scope. type: string scopeValue: description: The literal OAuth scope string. Immutable after creation. type: string state: description: Initial state. UNSPECIFIED defaults to PENDING_REVIEW. enum: - XAA_SCOPE_STATE_UNSPECIFIED - XAA_SCOPE_STATE_PENDING_REVIEW - XAA_SCOPE_STATE_ENABLED - XAA_SCOPE_STATE_DISABLED - XAA_SCOPE_STATE_REMOVED type: string x-speakeasy-unknown-values: allow xaaResourceServerId: description: The resource server this scope belongs to. type: string title: Xaa Scope Service Create Request type: object x-speakeasy-name-override: XAAScopeServiceCreateRequest c1.api.cross_app_access.v1.XAAScopeServiceCreateResponse: description: XAAScopeServiceCreateResponse returns the created scope. properties: scope: oneOf: - $ref: '#/components/schemas/c1.api.cross_app_access.v1.XAAScope' - type: 'null' title: Xaa Scope Service Create Response type: object x-speakeasy-name-override: XAAScopeServiceCreateResponse c1.api.cross_app_access.v1.XAAScope: description: >- XAAScope is a single OAuth scope exposed by a resource server, elevated into a governable object bound to its own entitlement. properties: appEntitlementId: description: The AppEntitlement created for this scope. type: string appId: description: The application that owns the resource server. type: string classification: description: Risk classification. enum: - XAA_SCOPE_CLASSIFICATION_UNSPECIFIED - XAA_SCOPE_CLASSIFICATION_READ - XAA_SCOPE_CLASSIFICATION_WRITE - XAA_SCOPE_CLASSIFICATION_DESTRUCTIVE - XAA_SCOPE_CLASSIFICATION_SENSITIVE - XAA_SCOPE_CLASSIFICATION_DANGEROUS type: string x-speakeasy-unknown-values: allow createdAt: format: date-time type: - string - 'null' deletedAt: format: date-time type: - string - 'null' description: description: Description of what the scope grants. type: string displayName: description: Display name for the scope. type: string id: description: Unique identifier for this scope. type: string lastDiscoveredAt: format: date-time type: - string - 'null' scopeValue: description: >- The literal OAuth scope string minted into the grant. Immutable after creation (RFC 6749 charset, max 256 bytes). type: string source: description: How C1 learned of the scope. enum: - XAA_SCOPE_SOURCE_UNSPECIFIED - XAA_SCOPE_SOURCE_ADMIN_DECLARED - XAA_SCOPE_SOURCE_DISCOVERED type: string x-speakeasy-unknown-values: allow state: description: Approval/lifecycle state. enum: - XAA_SCOPE_STATE_UNSPECIFIED - XAA_SCOPE_STATE_PENDING_REVIEW - XAA_SCOPE_STATE_ENABLED - XAA_SCOPE_STATE_DISABLED - XAA_SCOPE_STATE_REMOVED type: string x-speakeasy-unknown-values: allow updatedAt: format: date-time type: - string - 'null' xaaResourceServerId: description: The resource server this scope belongs to. type: string title: Xaa Scope type: object x-speakeasy-name-override: XAAScope securitySchemes: bearerAuth: scheme: bearer type: http oauth: description: >- This API uses OAuth2 with the Client Credential flow. Client Credentials must be sent in the BODY, not the headers. For an example of how to implement this, refer to the [c1TokenSource.Token()](https://github.com/ConductorOne/conductorone-sdk-go/blob/3375fe7c0126d17e7ec4e711693dee7b791023aa/token_source.go#L101-L187) function. flows: clientCredentials: scopes: {} tokenUrl: /auth/v1/token type: oauth2 ````