add MCP Cross-App Access issuer URL endpoint to public API spec

.generator/schemas/v2/openapi.yaml

@@ -60208,6 +60208,41 @@ components:
           $ref: "#/components/schemas/MaxSessionDurationUpdateData"
       required: [data]
       type: object
+    McpCrossAppAccessIssuerUrlType:
+      description: Data type of an MCP Cross-App Access issuer URL update.
+      enum: [org_config]
+      example: org_config
+      type: string
+      x-enum-varnames:
+        - ORG_CONFIG
+    McpCrossAppAccessIssuerUrlUpdateAttributes:
+      description: Attributes for the MCP Cross-App Access issuer URL update request.
+      properties:
+        issuer_url:
+          description: |-
+            The Okta OIDC issuer URL for MCP Cross-App Access, for example
+            `https://your-subdomain.okta.com`. Provide an empty string to unset
+            the issuer URL and opt the organization out of MCP Cross-App Access.
+          example: https://your-subdomain.okta.com
+          type: string
+      required: [issuer_url]
+      type: object
+    McpCrossAppAccessIssuerUrlUpdateData:
+      description: The data object for an MCP Cross-App Access issuer URL update request.
+      properties:
+        attributes:
+          $ref: "#/components/schemas/McpCrossAppAccessIssuerUrlUpdateAttributes"
+        type:
+          $ref: "#/components/schemas/McpCrossAppAccessIssuerUrlType"
+      required: [type, attributes]
+      type: object
+    McpCrossAppAccessIssuerUrlUpdateRequest:
+      description: A request to update the MCP Cross-App Access issuer URL for an organization.
+      properties:
+        data:
+          $ref: "#/components/schemas/McpCrossAppAccessIssuerUrlUpdateData"
+      required: [data]
+      type: object
     McpScanRequest:
       description: The top-level request object for submitting an MCP SCA dependency scan.
       properties:
@@ -154159,6 +154194,52 @@ paths:
         operator: OR
         permissions:
           - org_management
+  /api/v2/login/org_configs/mcp_cross_app_access_issuer_url:
+    put:
+      description: |-
+        Update the Okta OIDC issuer URL used for MCP Cross-App Access (XAA)
+        for the current organization. The URL must be a bare Okta issuer such
+        as `https://your-subdomain.okta.com` (no path, port, query, or fragment).
+        Provide an empty string to unset the issuer URL and opt the organization
+        out of MCP Cross-App Access.
+      operationId: UpdateLoginOrgConfigsMcpCrossAppAccessIssuerUrl
+      requestBody:
+        content:
+          application/json:
+            examples:
+              default:
+                value:
+                  data:
+                    attributes:
+                      issuer_url: https://your-subdomain.okta.com
+                    type: org_config
+            schema:
+              $ref: "#/components/schemas/McpCrossAppAccessIssuerUrlUpdateRequest"
+        required: true
+      responses:
+        "204":
+          description: No Content
+        "400":
+          $ref: "#/components/responses/BadRequestResponse"
+        "401":
+          $ref: "#/components/responses/UnauthorizedResponse"
+        "403":
+          $ref: "#/components/responses/ForbiddenResponse"
+        "429":
+          $ref: "#/components/responses/TooManyRequestsResponse"
+      security:
+        - apiKeyAuth: []
+          appKeyAuth: []
+        - AuthZ:
+            - org_management
+      summary: Update the MCP Cross-App Access issuer URL
+      tags: [Organizations]
+      "x-permission":
+        operator: OR
+        permissions:
+          - org_management
+      x-unstable: |-
+        **Note**: This endpoint is in Preview and may change in the future. It is not yet recommended for production use.
   /api/v2/logs:
     post:
       description: |-

api/datadog/configuration.go

@@ -963,6 +963,7 @@ func NewConfiguration() *Configuration {
 			"v2.UpdateForm":                                           false,
 			"v2.UpsertAndPublishFormVersion":                          false,
 			"v2.UpsertFormVersion":                                    false,
+			"v2.UpdateLoginOrgConfigsMcpCrossAppAccessIssuerUrl":      false,
 			"v2.UpdateOrgSamlConfigurations":                          false,
 			"v2.GetGovernanceControl":                                 false,
 			"v2.ListGovernanceControls":                               false,

api/datadogV2/api_organizations.go

@@ -678,6 +678,89 @@ func (a *OrganizationsApi) UpdateLoginOrgConfigsMaxSessionDuration(ctx _context.
 	return localVarHTTPResponse, nil
 }
 
+// UpdateLoginOrgConfigsMcpCrossAppAccessIssuerUrl Update the MCP Cross-App Access issuer URL.
+// Update the Okta OIDC issuer URL used for MCP Cross-App Access (XAA)
+// for the current organization. The URL must be a bare Okta issuer such
+// as `https://your-subdomain.okta.com` (no path, port, query, or fragment).
+// Provide an empty string to unset the issuer URL and opt the organization
+// out of MCP Cross-App Access.
+func (a *OrganizationsApi) UpdateLoginOrgConfigsMcpCrossAppAccessIssuerUrl(ctx _context.Context, body McpCrossAppAccessIssuerUrlUpdateRequest) (*_nethttp.Response, error) {
+	var (
+		localVarHTTPMethod = _nethttp.MethodPut
+		localVarPostBody   interface{}
+	)
+
+	operationId := "v2.UpdateLoginOrgConfigsMcpCrossAppAccessIssuerUrl"
+	isOperationEnabled := a.Client.Cfg.IsUnstableOperationEnabled(operationId)
+	if !isOperationEnabled {
+		return nil, datadog.GenericOpenAPIError{ErrorMessage: _fmt.Sprintf("Unstable operation '%s' is disabled", operationId)}
+	}
+	if isOperationEnabled && a.Client.Cfg.Debug {
+		_log.Printf("WARNING: Using unstable operation '%s'", operationId)
+	}
+
+	localBasePath, err := a.Client.Cfg.ServerURLWithContext(ctx, "v2.OrganizationsApi.UpdateLoginOrgConfigsMcpCrossAppAccessIssuerUrl")
+	if err != nil {
+		return nil, datadog.GenericOpenAPIError{ErrorMessage: err.Error()}
+	}
+
+	localVarPath := localBasePath + "/api/v2/login/org_configs/mcp_cross_app_access_issuer_url"
+
+	localVarHeaderParams := make(map[string]string)
+	localVarQueryParams := _neturl.Values{}
+	localVarFormParams := _neturl.Values{}
+	localVarHeaderParams["Content-Type"] = "application/json"
+	localVarHeaderParams["Accept"] = "*/*"
+
+	// body params
+	localVarPostBody = &body
+	if a.Client.Cfg.DelegatedTokenConfig != nil {
+		err = datadog.UseDelegatedTokenAuth(ctx, &localVarHeaderParams, a.Client.Cfg.DelegatedTokenConfig)
+		if err != nil {
+			return nil, err
+		}
+	} else {
+		datadog.SetAuthKeys(
+			ctx,
+			&localVarHeaderParams,
+			[2]string{"apiKeyAuth", "DD-API-KEY"},
+			[2]string{"appKeyAuth", "DD-APPLICATION-KEY"},
+		)
+	}
+	req, err := a.Client.PrepareRequest(ctx, localVarPath, localVarHTTPMethod, localVarPostBody, localVarHeaderParams, localVarQueryParams, localVarFormParams, nil)
+	if err != nil {
+		return nil, err
+	}
+
+	localVarHTTPResponse, err := a.Client.CallAPI(req)
+	if err != nil || localVarHTTPResponse == nil {
+		return localVarHTTPResponse, err
+	}
+
+	localVarBody, err := datadog.ReadBody(localVarHTTPResponse)
+	if err != nil {
+		return localVarHTTPResponse, err
+	}
+
+	if localVarHTTPResponse.StatusCode >= 300 {
+		newErr := datadog.GenericOpenAPIError{
+			ErrorBody:    localVarBody,
+			ErrorMessage: localVarHTTPResponse.Status,
+		}
+		if localVarHTTPResponse.StatusCode == 400 || localVarHTTPResponse.StatusCode == 401 || localVarHTTPResponse.StatusCode == 403 || localVarHTTPResponse.StatusCode == 429 {
+			var v APIErrorResponse
+			err = a.Client.Decode(&v, localVarBody, localVarHTTPResponse.Header.Get("Content-Type"))
+			if err != nil {
+				return localVarHTTPResponse, newErr
+			}
+			newErr.ErrorModel = v
+		}
+		return localVarHTTPResponse, newErr
+	}
+
+	return localVarHTTPResponse, nil
+}
+
 // UpdateOrgConfig Update a specific Org Config.
 // Update the value of a specific Org Config.
 func (a *OrganizationsApi) UpdateOrgConfig(ctx _context.Context, orgConfigName string, body OrgConfigWriteRequest) (OrgConfigGetResponse, *_nethttp.Response, error) {

api/datadogV2/doc.go

@@ -865,6 +865,7 @@
 //   - [OrganizationsApi.ListOrgs]
 //   - [OrganizationsApi.ListSAMLConfigurations]
 //   - [OrganizationsApi.UpdateLoginOrgConfigsMaxSessionDuration]
+//   - [OrganizationsApi.UpdateLoginOrgConfigsMcpCrossAppAccessIssuerUrl]
 //   - [OrganizationsApi.UpdateOrgConfig]
 //   - [OrganizationsApi.UpdateOrgSamlConfigurations]
 //   - [OrganizationsApi.UpdateSAMLConfiguration]

api/datadogV2/model_mcp_cross_app_access_issuer_url_type.go

@@ -0,0 +1,64 @@
+// Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.
+// This product includes software developed at Datadog (https://www.datadoghq.com/).
+// Copyright 2019-Present Datadog, Inc.
+
+package datadogV2
+
+import (
+	"fmt"
+
+	"github.com/DataDog/datadog-api-client-go/v2/api/datadog"
+)
+
+// McpCrossAppAccessIssuerUrlType Data type of an MCP Cross-App Access issuer URL update.
+type McpCrossAppAccessIssuerUrlType string
+
+// List of McpCrossAppAccessIssuerUrlType.
+const (
+	MCPCROSSAPPACCESSISSUERURLTYPE_ORG_CONFIG McpCrossAppAccessIssuerUrlType = "org_config"
+)
+
+var allowedMcpCrossAppAccessIssuerUrlTypeEnumValues = []McpCrossAppAccessIssuerUrlType{
+	MCPCROSSAPPACCESSISSUERURLTYPE_ORG_CONFIG,
+}
+
+// GetAllowedValues reeturns the list of possible values.
+func (v *McpCrossAppAccessIssuerUrlType) GetAllowedValues() []McpCrossAppAccessIssuerUrlType {
+	return allowedMcpCrossAppAccessIssuerUrlTypeEnumValues
+}
+
+// UnmarshalJSON deserializes the given payload.
+func (v *McpCrossAppAccessIssuerUrlType) UnmarshalJSON(src []byte) error {
+	var value string
+	err := datadog.Unmarshal(src, &value)
+	if err != nil {
+		return err
+	}
+	*v = McpCrossAppAccessIssuerUrlType(value)
+	return nil
+}
+
+// NewMcpCrossAppAccessIssuerUrlTypeFromValue returns a pointer to a valid McpCrossAppAccessIssuerUrlType
+// for the value passed as argument, or an error if the value passed is not allowed by the enum.
+func NewMcpCrossAppAccessIssuerUrlTypeFromValue(v string) (*McpCrossAppAccessIssuerUrlType, error) {
+	ev := McpCrossAppAccessIssuerUrlType(v)
+	if ev.IsValid() {
+		return &ev, nil
+	}
+	return nil, fmt.Errorf("invalid value '%v' for McpCrossAppAccessIssuerUrlType: valid values are %v", v, allowedMcpCrossAppAccessIssuerUrlTypeEnumValues)
+}
+
+// IsValid return true if the value is valid for the enum, false otherwise.
+func (v McpCrossAppAccessIssuerUrlType) IsValid() bool {
+	for _, existing := range allowedMcpCrossAppAccessIssuerUrlTypeEnumValues {
+		if existing == v {
+			return true
+		}
+	}
+	return false
+}
+
+// Ptr returns reference to McpCrossAppAccessIssuerUrlType value.
+func (v McpCrossAppAccessIssuerUrlType) Ptr() *McpCrossAppAccessIssuerUrlType {
+	return &v
+}

api/datadogV2/model_mcp_cross_app_access_issuer_url_update_attributes.go

@@ -0,0 +1,103 @@
+// Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.
+// This product includes software developed at Datadog (https://www.datadoghq.com/).
+// Copyright 2019-Present Datadog, Inc.
+
+package datadogV2
+
+import (
+	"fmt"
+
+	"github.com/DataDog/datadog-api-client-go/v2/api/datadog"
+)
+
+// McpCrossAppAccessIssuerUrlUpdateAttributes Attributes for the MCP Cross-App Access issuer URL update request.
+type McpCrossAppAccessIssuerUrlUpdateAttributes struct {
+	// The Okta OIDC issuer URL for MCP Cross-App Access, for example
+	// `https://your-subdomain.okta.com`. Provide an empty string to unset
+	// the issuer URL and opt the organization out of MCP Cross-App Access.
+	IssuerUrl string `json:"issuer_url"`
+	// UnparsedObject contains the raw value of the object if there was an error when deserializing into the struct
+	UnparsedObject       map[string]interface{} `json:"-"`
+	AdditionalProperties map[string]interface{} `json:"-"`
+}
+
+// NewMcpCrossAppAccessIssuerUrlUpdateAttributes instantiates a new McpCrossAppAccessIssuerUrlUpdateAttributes object.
+// This constructor will assign default values to properties that have it defined,
+// and makes sure properties required by API are set, but the set of arguments
+// will change when the set of required properties is changed.
+func NewMcpCrossAppAccessIssuerUrlUpdateAttributes(issuerUrl string) *McpCrossAppAccessIssuerUrlUpdateAttributes {
+	this := McpCrossAppAccessIssuerUrlUpdateAttributes{}
+	this.IssuerUrl = issuerUrl
+	return &this
+}
+
+// NewMcpCrossAppAccessIssuerUrlUpdateAttributesWithDefaults instantiates a new McpCrossAppAccessIssuerUrlUpdateAttributes object.
+// This constructor will only assign default values to properties that have it defined,
+// but it doesn't guarantee that properties required by API are set.
+func NewMcpCrossAppAccessIssuerUrlUpdateAttributesWithDefaults() *McpCrossAppAccessIssuerUrlUpdateAttributes {
+	this := McpCrossAppAccessIssuerUrlUpdateAttributes{}
+	return &this
+}
+
+// GetIssuerUrl returns the IssuerUrl field value.
+func (o *McpCrossAppAccessIssuerUrlUpdateAttributes) GetIssuerUrl() string {
+	if o == nil {
+		var ret string
+		return ret
+	}
+	return o.IssuerUrl
+}
+
+// GetIssuerUrlOk returns a tuple with the IssuerUrl field value
+// and a boolean to check if the value has been set.
+func (o *McpCrossAppAccessIssuerUrlUpdateAttributes) GetIssuerUrlOk() (*string, bool) {
+	if o == nil {
+		return nil, false
+	}
+	return &o.IssuerUrl, true
+}
+
+// SetIssuerUrl sets field value.
+func (o *McpCrossAppAccessIssuerUrlUpdateAttributes) SetIssuerUrl(v string) {
+	o.IssuerUrl = v
+}
+
+// MarshalJSON serializes the struct using spec logic.
+func (o McpCrossAppAccessIssuerUrlUpdateAttributes) MarshalJSON() ([]byte, error) {
+	toSerialize := map[string]interface{}{}
+	if o.UnparsedObject != nil {
+		return datadog.Marshal(o.UnparsedObject)
+	}
+	toSerialize["issuer_url"] = o.IssuerUrl
+
+	for key, value := range o.AdditionalProperties {
+		toSerialize[key] = value
+	}
+	return datadog.Marshal(toSerialize)
+}
+
+// UnmarshalJSON deserializes the given payload.
+func (o *McpCrossAppAccessIssuerUrlUpdateAttributes) UnmarshalJSON(bytes []byte) (err error) {
+	all := struct {
+		IssuerUrl *string `json:"issuer_url"`
+	}{}
+	if err = datadog.Unmarshal(bytes, &all); err != nil {
+		return datadog.Unmarshal(bytes, &o.UnparsedObject)
+	}
+	if all.IssuerUrl == nil {
+		return fmt.Errorf("required field issuer_url missing")
+	}
+	additionalProperties := make(map[string]interface{})
+	if err = datadog.UnmarshalUseNumber(bytes, &additionalProperties); err == nil {
+		datadog.DeleteKeys(additionalProperties, &[]string{"issuer_url"})
+	} else {
+		return err
+	}
+	o.IssuerUrl = *all.IssuerUrl
+
+	if len(additionalProperties) > 0 {
+		o.AdditionalProperties = additionalProperties
+	}
+
+	return nil
+}