docs(myorgs): document self-service 3P app access and XAA settings - #1794
Open
dlozlla wants to merge 1 commit into
Open
docs(myorgs): document self-service 3P app access and XAA settings#1794dlozlla wants to merge 1 commit into
dlozlla wants to merge 1 commit into
Conversation
Add the third_party_client_access client attribute and the cross_app_access_resource_app Connection Profile attribute to my-organization-api.mdx and connection-profile.mdx, letting Organization admins self-service configure third-party application access and Cross App Access (XAA) Resource App status via the My Organization API and Embeddable UI Components. Cross-link from the existing tenant-admin-facing third-party-applications and domain-level-connection docs. Per-endpoint request/response details are covered by the auto-generated My Organization API reference, updated separately from the OpenAPI spec.
Contributor
|
Preview deployment for your docs. Learn more about Mintlify Previews.
💡 Tip: Enable Workflows to automatically generate PRs for you. |
Contributor
|
Preview deployment for your docs. Learn more about Mintlify Previews.
💡 Tip: Enable Workflows to automatically generate PRs for you. |
Contributor
|
Preview deployment for your docs. Learn more about Mintlify Previews.
💡 Tip: Enable Workflows to automatically generate PRs for you. |
Contributor
Summary
Redirects per inputRedirects in main/docs/authenticate/identity-providers/promote-connections-to-domain-level.mdx
|
avanscoy
reviewed
Aug 28, 2026
| | `connection_name_prefix_template` | Represents the prefix that must be used for naming connections. Maps to the `name` parameter on a connection. This value supports variable substitution for the organization ID and the organization name. The OIN workflow must substitute these values to generate the final prefix. Variables are enclosed in braces ({}). <p></p> Supported variables: <p></p> <ul><li>`org_id`: The Organization ID</li><li>`org_name`: The [Organization name](/docs/manage-users/organizations/configure-organizations/create-organizations#auth0-dashboard)</li></ul> <p></p> Example: `con-{org_id}-`| | ||
| | `enabled_features` | This list specifies the features which will be supported by the configured connection. Features not on the list are not allowed.<p></p> Supported values: <ul><li>`scim`: When present, SCIM may be configured on the connection.</li><li>`universal_logout`: When present, the Universal Logout feature may be used with this connection.</li></ul> | | ||
| | `organization.assign_membership_on_login` | Specifies whether users should automatically be assigned membership in the organization on login. This maps to the `assign_membership_on_login` property of the `enabled_connections` sub-resource of the organization. <Callout icon="file-lines" color="#0EA5E9" iconType="regular"> For Express Configuration integrations with Okta, `optional` is treated as `required`</Callout> <p></p>| | ||
| | `cross_app_access_resource_app` | **Optional.** Controls which values Organization admins can set for the [Cross App Access (XAA)](/docs/ai-agents-mcp/cross-app-access) Resource App role on their identity providers via the My Organization API. Shape: `{ "status": { "default_value": "enabled" \| "disabled", "allowed_values": ["enabled", "disabled"] } }`. If omitted from the Connection Profile, Organization admins cannot configure this role at all. `allowed_values` is optional; when set, it must contain at least two values. | |
Contributor
There was a problem hiding this comment.
Suggested change
| | `cross_app_access_resource_app` | **Optional.** Controls which values Organization admins can set for the [Cross App Access (XAA)](/docs/ai-agents-mcp/cross-app-access) Resource App role on their identity providers via the My Organization API. Shape: `{ "status": { "default_value": "enabled" \| "disabled", "allowed_values": ["enabled", "disabled"] } }`. If omitted from the Connection Profile, Organization admins cannot configure this role at all. `allowed_values` is optional; when set, it must contain at least two values. | | |
| | `cross_app_access_resource_app` | Optional. Controls which values Organization Admins can set for the [Cross App Access (XAA)](/docs/ai-agents-mcp/cross-app-access) Resource Application role on their identity providers via the My Organization API. Shape: `{ "status": { "default_value": "enabled" \| "disabled", "allowed_values": ["enabled", "disabled"] } }`. If omitted from the Connection Profile, Organization admins cannot configure this role at all. `allowed_values` is optional; when set, it must contain at least two values. | |
avanscoy
reviewed
Aug 28, 2026
|
|
||
| When you promote a connection to the domain level, any [third-party application](/docs/get-started/applications/third-party-applications) in your tenant can use it to authenticate users. This enables third-party applications to access your identity providers. Third-party applications can only use domain-level connections, except through [Cross App Access (XAA)](/docs/ai-agents-mcp/cross-app-access), where access is authorized in the corresponding enterprise IdP. | ||
|
|
||
| For connections associated with an Organization, Organization admins can self-service configure this same setting through the My Organization API and its Embeddable UI Components, if you allow it. To learn more, read [My Organization API](/docs/manage-users/my-organization-api). |
Contributor
There was a problem hiding this comment.
Suggested change
| For connections associated with an Organization, Organization admins can self-service configure this same setting through the My Organization API and its Embeddable UI Components, if you allow it. To learn more, read [My Organization API](/docs/manage-users/my-organization-api). | |
| For connections associated with an Organization, Organization Admins can self-service configure this same setting through the My Organization API and its Embeddable UI Components. To learn more, read [My Organization API](/docs/manage-users/my-organization-api). |
avanscoy
reviewed
Aug 28, 2026
|
|
||
| If either condition is missing, the authorization request fails with `invalid_request`. To enable third-party application access on an Organization, read [Enable Third-Party Application Access for an Organization](/docs/manage-users/organizations/configure-organizations/enable-third-party-application-access). | ||
|
|
||
| Organization admins can also self-service both conditions through the My Organization API and its Embeddable UI Components, if you allow it. To learn more, read [My Organization API](/docs/manage-users/my-organization-api). |
Contributor
There was a problem hiding this comment.
Suggested change
| Organization admins can also self-service both conditions through the My Organization API and its Embeddable UI Components, if you allow it. To learn more, read [My Organization API](/docs/manage-users/my-organization-api). | |
| Organization Admins can also self-service both conditions through the My Organization API and its Embeddable UI Components. To learn more, read [My Organization API](/docs/manage-users/my-organization-api). |
avanscoy
reviewed
Aug 28, 2026
| | `user_attribute_profile_id` | **User Attribute Profile ID**. ID of the [User Attribute Profile](/docs/authenticate/enterprise-connections/user-attribute-profile) used with the application when leveraging the My Organization API. If it is not provided, My Organization API features that require a User Attribute Profile to be present will not function. This ID must refer to a valid User Attribute Profile in the same tenant.| | ||
| | `allowed_strategies` | **Array of strings.** Each string is unique and refers to a supported strategy. The supported strategies - the values for the enum - are as follows: `pingfederate`, `ad`, `adfs`, `waad`, `google-apps`, `okta`, `oidc`, and `samlp`.| | ||
| | `connection_deletion_behavior` | **Enum (allow, allow_if_empty).** Describes how the My Organization API behaves when an end user tries to delete a connection when attempted via the My Organization API from this application. The values and description of the enum are as follows: <p></p> 1. `allow`: Given the user has the correct scope, a user can delete the connection which results in all users originating from the connection being deleted. <p></p> 2.`allow_if_empty`: Given the user has the correct scope, a user can only delete the connection if there are no users in the connection. If users are present, the My Organization API will return an error and won’t proceed with the deletion.| | ||
| | `third_party_client_access` | **Object.** Controls which values Organization admins can set for third-party application access on their Organization via the My Organization API. Shape: `{ "default_value": "block" \| "allow", "allowed_values": ["block", "allow"] }`. Defaults to `{ "default_value": "block", "allowed_values": ["block"] }`, meaning Organization admins cannot enable third-party application access until you explicitly allow it here.| |
Contributor
There was a problem hiding this comment.
Suggested change
| | `third_party_client_access` | **Object.** Controls which values Organization admins can set for third-party application access on their Organization via the My Organization API. Shape: `{ "default_value": "block" \| "allow", "allowed_values": ["block", "allow"] }`. Defaults to `{ "default_value": "block", "allowed_values": ["block"] }`, meaning Organization admins cannot enable third-party application access until you explicitly allow it here.| | |
| | `third_party_client_access` | **Object.** Controls which values Organization Admins can set third-party application access on their Organization via the My Organization API. Shape: `{ "default_value": "block" \| "allow", "allowed_values": ["block", "allow"] }`. Defaults to `{ "default_value": "block", "allowed_values": ["block"] }`, means Organization Admins cannot enable third-party application access until explicitly allowed.| |
avanscoy
reviewed
Aug 28, 2026
| | `connection_deletion_behavior` | **Enum (allow, allow_if_empty).** Describes how the My Organization API behaves when an end user tries to delete a connection when attempted via the My Organization API from this application. The values and description of the enum are as follows: <p></p> 1. `allow`: Given the user has the correct scope, a user can delete the connection which results in all users originating from the connection being deleted. <p></p> 2.`allow_if_empty`: Given the user has the correct scope, a user can only delete the connection if there are no users in the connection. If users are present, the My Organization API will return an error and won’t proceed with the deletion.| | ||
| | `third_party_client_access` | **Object.** Controls which values Organization admins can set for third-party application access on their Organization via the My Organization API. Shape: `{ "default_value": "block" \| "allow", "allowed_values": ["block", "allow"] }`. Defaults to `{ "default_value": "block", "allowed_values": ["block"] }`, meaning Organization admins cannot enable third-party application access until you explicitly allow it here.| | ||
|
|
||
| The [Connection Profile](/docs/authenticate/enterprise-connections/connection-profile) referenced by `connection_profile_id` similarly controls whether Organization admins can configure the [Cross App Access (XAA)](/docs/ai-agents-mcp/cross-app-access) Resource App role on their identity providers via the My Organization API. |
Contributor
There was a problem hiding this comment.
Suggested change
| The [Connection Profile](/docs/authenticate/enterprise-connections/connection-profile) referenced by `connection_profile_id` similarly controls whether Organization admins can configure the [Cross App Access (XAA)](/docs/ai-agents-mcp/cross-app-access) Resource App role on their identity providers via the My Organization API. | |
| The [Connection Profile](/docs/authenticate/enterprise-connections/connection-profile), `connection_profile_id`, controls whether Organization Admins can configure the [Cross App Access (XAA)](/docs/ai-agents-mcp/cross-app-access) Resource Application role on their identity providers via the My Organization API. |
avanscoy
reviewed
Aug 28, 2026
| 2. Allow if Empty: Given the user has the correct scope, a user can only delete the connection if there are no Users in the connection. If users are present, the My Organization API will return an error and won’t proceed with the deletion. <br></br> | ||
|
|
||
| E. Configure the User Access Authorization to Unauthorized, Authorized, or All. <br></br> | ||
| E. **Optional**. Configure if you want to Allow Organization Admin to Set Third-Party Access. <br></br> |
Contributor
There was a problem hiding this comment.
Suggested change
| E. **Optional**. Configure if you want to Allow Organization Admin to Set Third-Party Access. <br></br> | |
| E. Optional. Configure if you want to allow Organization Admin to set third-party access. <br></br> |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Add the third_party_client_access client attribute and the cross_app_access_resource_app Connection Profile attribute to my-organization-api.mdx and connection-profile.mdx, letting Organization admins self-service configure third-party application access and Cross App Access (XAA) Resource App status via the My Organization API and Embeddable UI Components. Cross-link from the existing tenant-admin-facing third-party-applications and domain-level-connection docs. Per-endpoint request/response details are covered by the auto-generated My Organization API reference, updated separately from the OpenAPI spec.