add MCP Cross-App Access issuer URL endpoint to public API spec

.generator/schemas/v2/openapi.yaml

@@ -60208,6 +60208,41 @@ components:
           $ref: "#/components/schemas/MaxSessionDurationUpdateData"
       required: [data]
       type: object
+    McpCrossAppAccessIssuerUrlType:
+      description: Data type of an MCP Cross-App Access issuer URL update.
+      enum: [org_config]
+      example: org_config
+      type: string
+      x-enum-varnames:
+        - ORG_CONFIG
+    McpCrossAppAccessIssuerUrlUpdateAttributes:
+      description: Attributes for the MCP Cross-App Access issuer URL update request.
+      properties:
+        issuer_url:
+          description: |-
+            The Okta OIDC issuer URL for MCP Cross-App Access, for example
+            `https://your-subdomain.okta.com`. Provide an empty string to unset
+            the issuer URL and opt the organization out of MCP Cross-App Access.
+          example: https://your-subdomain.okta.com
+          type: string
+      required: [issuer_url]
+      type: object
+    McpCrossAppAccessIssuerUrlUpdateData:
+      description: The data object for an MCP Cross-App Access issuer URL update request.
+      properties:
+        attributes:
+          $ref: "#/components/schemas/McpCrossAppAccessIssuerUrlUpdateAttributes"
+        type:
+          $ref: "#/components/schemas/McpCrossAppAccessIssuerUrlType"
+      required: [type, attributes]
+      type: object
+    McpCrossAppAccessIssuerUrlUpdateRequest:
+      description: A request to update the MCP Cross-App Access issuer URL for an organization.
+      properties:
+        data:
+          $ref: "#/components/schemas/McpCrossAppAccessIssuerUrlUpdateData"
+      required: [data]
+      type: object
     McpScanRequest:
       description: The top-level request object for submitting an MCP SCA dependency scan.
       properties:
@@ -154159,6 +154194,52 @@ paths:
         operator: OR
         permissions:
           - org_management
+  /api/v2/login/org_configs/mcp_cross_app_access_issuer_url:
+    put:
+      description: |-
+        Update the Okta OIDC issuer URL used for MCP Cross-App Access (XAA)
+        for the current organization. The URL must be a bare Okta issuer such
+        as `https://your-subdomain.okta.com` (no path, port, query, or fragment).
+        Provide an empty string to unset the issuer URL and opt the organization
+        out of MCP Cross-App Access.
+      operationId: UpdateLoginOrgConfigsMcpCrossAppAccessIssuerUrl
+      requestBody:
+        content:
+          application/json:
+            examples:
+              default:
+                value:
+                  data:
+                    attributes:
+                      issuer_url: https://your-subdomain.okta.com
+                    type: org_config
+            schema:
+              $ref: "#/components/schemas/McpCrossAppAccessIssuerUrlUpdateRequest"
+        required: true
+      responses:
+        "204":
+          description: No Content
+        "400":
+          $ref: "#/components/responses/BadRequestResponse"
+        "401":
+          $ref: "#/components/responses/UnauthorizedResponse"
+        "403":
+          $ref: "#/components/responses/ForbiddenResponse"
+        "429":
+          $ref: "#/components/responses/TooManyRequestsResponse"
+      security:
+        - apiKeyAuth: []
+          appKeyAuth: []
+        - AuthZ:
+            - org_management
+      summary: Update the MCP Cross-App Access issuer URL
+      tags: [Organizations]
+      "x-permission":
+        operator: OR
+        permissions:
+          - org_management
+      x-unstable: |-
+        **Note**: This endpoint is in Preview and may change in the future. It is not yet recommended for production use.
   /api/v2/logs:
     post:
       description: |-

features/v2/organizations.feature

@@ -168,6 +168,22 @@ Feature: Organizations
     When the request is sent
     Then the response status is 404 Not Found
 
+  @generated @skip @team:DataDog/delegated-auth-login
+  Scenario: Update the MCP Cross-App Access issuer URL returns "Bad Request" response
+    Given operation "UpdateLoginOrgConfigsMcpCrossAppAccessIssuerUrl" enabled
+    And new "UpdateLoginOrgConfigsMcpCrossAppAccessIssuerUrl" request
+    And body with value {"data": {"attributes": {"issuer_url": "https://your-subdomain.okta.com"}, "type": "org_config"}}
+    When the request is sent
+    Then the response status is 400 Bad Request
+
+  @generated @skip @team:DataDog/delegated-auth-login
+  Scenario: Update the MCP Cross-App Access issuer URL returns "No Content" response
+    Given operation "UpdateLoginOrgConfigsMcpCrossAppAccessIssuerUrl" enabled
+    And new "UpdateLoginOrgConfigsMcpCrossAppAccessIssuerUrl" request
+    And body with value {"data": {"attributes": {"issuer_url": "https://your-subdomain.okta.com"}, "type": "org_config"}}
+    When the request is sent
+    Then the response status is 204 No Content
+
   @generated @skip @team:DataDog/delegated-auth-login
   Scenario: Update the maximum session duration returns "Bad Request" response
     Given new "UpdateLoginOrgConfigsMaxSessionDuration" request

features/v2/undo.json

@@ -4768,6 +4768,12 @@
       "type": "idempotent"
     }
   },
+  "UpdateLoginOrgConfigsMcpCrossAppAccessIssuerUrl": {
+    "tag": "Organizations",
+    "undo": {
+      "type": "idempotent"
+    }
+  },
   "SubmitLog": {
     "tag": "Logs",
     "undo": {

private/bdd_runner/src/support/scenarios_model_mapping.ts

@@ -9616,6 +9616,13 @@ export const ScenariosModelMappings: { [key: string]: OperationMapping } = {
     },
     operationResponseType: "{}",
   },
+  "OrganizationsApi.V2.UpdateLoginOrgConfigsMcpCrossAppAccessIssuerUrl": {
+    body: {
+      type: "McpCrossAppAccessIssuerUrlUpdateRequest",
+      format: "",
+    },
+    operationResponseType: "{}",
+  },
   "OrganizationsApi.V2.ListOrgs": {
     filterName: {
       type: "string",

services/organizations/src/v2/OrganizationsApi.ts

@@ -31,6 +31,7 @@ import { GlobalOrgsResponse } from "./models/GlobalOrgsResponse";
 import { JSONAPIErrorResponse } from "./models/JSONAPIErrorResponse";
 import { ManagedOrgsResponse } from "./models/ManagedOrgsResponse";
 import { MaxSessionDurationUpdateRequest } from "./models/MaxSessionDurationUpdateRequest";
+import { McpCrossAppAccessIssuerUrlUpdateRequest } from "./models/McpCrossAppAccessIssuerUrlUpdateRequest";
 import { OrgConfigGetResponse } from "./models/OrgConfigGetResponse";
 import { OrgConfigListResponse } from "./models/OrgConfigListResponse";
 import { OrgConfigWriteRequest } from "./models/OrgConfigWriteRequest";
@@ -375,6 +376,76 @@ export class OrganizationsApiRequestFactory extends BaseAPIRequestFactory {
     return requestContext;
   }
 
+  public async updateLoginOrgConfigsMcpCrossAppAccessIssuerUrl(
+    body: McpCrossAppAccessIssuerUrlUpdateRequest,
+    _options?: Configuration,
+  ): Promise<RequestContext> {
+    const _config = _options || this.configuration;
+
+    if (
+      !_config.unstableOperations[
+        "OrganizationsApi.v2.updateLoginOrgConfigsMcpCrossAppAccessIssuerUrl"
+      ]
+    ) {
+      throw new Error(
+        "Unstable operation 'updateLoginOrgConfigsMcpCrossAppAccessIssuerUrl' is disabled. Enable it by setting `configuration.unstableOperations['OrganizationsApi.v2.updateLoginOrgConfigsMcpCrossAppAccessIssuerUrl'] = true`",
+      );
+    }
+
+    // verify required parameter 'body' is not null or undefined
+    if (body === null || body === undefined) {
+      throw new RequiredError(
+        "body",
+        "updateLoginOrgConfigsMcpCrossAppAccessIssuerUrl",
+      );
+    }
+
+    // Path Params
+    const localVarPath =
+      "/api/v2/login/org_configs/mcp_cross_app_access_issuer_url";
+
+    // Make Request Context
+    const { server, overrides } = _config.getServerAndOverrides(
+      "OrganizationsApi.v2.updateLoginOrgConfigsMcpCrossAppAccessIssuerUrl",
+      OrganizationsApi.operationServers,
+    );
+    const requestContext = server.makeRequestContext(
+      localVarPath,
+      HttpMethod.PUT,
+      overrides,
+    );
+    requestContext.setHeaderParam("Accept", "*/*");
+    requestContext.setHttpConfig(_config.httpConfig);
+
+    // Set User-Agent
+    if (this.userAgent) {
+      requestContext.setHeaderParam("User-Agent", this.userAgent);
+    }
+
+    // Body Params
+    const contentType = getPreferredMediaType(["application/json"]);
+    requestContext.setHeaderParam("Content-Type", contentType);
+    const serializedBody = stringify(
+      serialize(
+        body,
+        TypingInfo,
+        "McpCrossAppAccessIssuerUrlUpdateRequest",
+        "",
+      ),
+      contentType,
+    );
+    requestContext.setBody(serializedBody);
+
+    // Apply auth methods
+    applySecurityAuthentication(_config, requestContext, [
+      "apiKeyAuth",
+      "appKeyAuth",
+      "AuthZ",
+    ]);
+
+    return requestContext;
+  }
+
   public async updateOrgConfig(
     orgConfigName: string,
     body: OrgConfigWriteRequest,
@@ -1010,6 +1081,56 @@ export class OrganizationsApiResponseProcessor {
     );
   }
 
+  /**
+   * Unwraps the actual response sent by the server from the response context and deserializes the response content
+   * to the expected objects
+   *
+   * @params response Response returned by the server for a request to updateLoginOrgConfigsMcpCrossAppAccessIssuerUrl
+   * @throws ApiException if the response code was not in [200, 299]
+   */
+  public async updateLoginOrgConfigsMcpCrossAppAccessIssuerUrl(
+    response: ResponseContext,
+  ): Promise<void> {
+    const contentType = normalizeMediaType(response.headers["content-type"]);
+    if (response.httpStatusCode === 204) {
+      return;
+    }
+    if (
+      response.httpStatusCode === 400 ||
+      response.httpStatusCode === 401 ||
+      response.httpStatusCode === 403 ||
+      response.httpStatusCode === 429
+    ) {
+      const bodyText = parse(await response.body.text(), contentType);
+      let body: APIErrorResponse;
+      try {
+        body = deserialize(
+          bodyText,
+          TypingInfo,
+          "APIErrorResponse",
+        ) as APIErrorResponse;
+      } catch (error) {
+        logger.debug(`Got error deserializing error: ${error}`);
+        throw new ApiException<APIErrorResponse>(
+          response.httpStatusCode,
+          bodyText,
+        );
+      }
+      throw new ApiException<APIErrorResponse>(response.httpStatusCode, body);
+    }
+
+    // Work around for missing responses in specification, e.g. for petstore.yaml
+    if (response.httpStatusCode >= 200 && response.httpStatusCode <= 299) {
+      return;
+    }
+
+    const body = (await response.body.text()) || "";
+    throw new ApiException<string>(
+      response.httpStatusCode,
+      'Unknown API Status Code!\nBody: "' + body + '"',
+    );
+  }
+
   /**
    * Unwraps the actual response sent by the server from the response context and deserializes the response content
    * to the expected objects
@@ -1302,6 +1423,13 @@ export interface OrganizationsApiUpdateLoginOrgConfigsMaxSessionDurationRequest
   body: MaxSessionDurationUpdateRequest;
 }
 
+export interface OrganizationsApiUpdateLoginOrgConfigsMcpCrossAppAccessIssuerUrlRequest {
+  /**
+   * @type McpCrossAppAccessIssuerUrlUpdateRequest
+   */
+  body: McpCrossAppAccessIssuerUrlUpdateRequest;
+}
+
 export interface OrganizationsApiUpdateOrgConfigRequest {
   /**
    * The name of an Org Config.
@@ -1558,6 +1686,34 @@ export class OrganizationsApi {
     });
   }
 
+  /**
+   * Update the Okta OIDC issuer URL used for MCP Cross-App Access (XAA)
+   * for the current organization. The URL must be a bare Okta issuer such
+   * as `https://your-subdomain.okta.com` (no path, port, query, or fragment).
+   * Provide an empty string to unset the issuer URL and opt the organization
+   * out of MCP Cross-App Access.
+   * @param param The request object
+   */
+  public updateLoginOrgConfigsMcpCrossAppAccessIssuerUrl(
+    param: OrganizationsApiUpdateLoginOrgConfigsMcpCrossAppAccessIssuerUrlRequest,
+    options?: Configuration,
+  ): Promise<void> {
+    const requestContextPromise =
+      this.requestFactory.updateLoginOrgConfigsMcpCrossAppAccessIssuerUrl(
+        param.body,
+        options,
+      );
+    return requestContextPromise.then((requestContext) => {
+      return this.configuration.httpApi
+        .send(requestContext)
+        .then((responseContext) => {
+          return this.responseProcessor.updateLoginOrgConfigsMcpCrossAppAccessIssuerUrl(
+            responseContext,
+          );
+        });
+    });
+  }
+
   /**
    * Update the value of a specific Org Config.
    * @param param The request object

services/organizations/src/v2/index.ts

@@ -4,6 +4,7 @@ export {
   OrganizationsApiListGlobalOrgsRequest,
   OrganizationsApiListOrgsRequest,
   OrganizationsApiUpdateLoginOrgConfigsMaxSessionDurationRequest,
+  OrganizationsApiUpdateLoginOrgConfigsMcpCrossAppAccessIssuerUrlRequest,
   OrganizationsApiUpdateOrgConfigRequest,
   OrganizationsApiUpdateOrgSamlConfigurationsRequest,
   OrganizationsApiUpdateSAMLConfigurationRequest,
@@ -35,6 +36,10 @@ export { MaxSessionDurationType } from "./models/MaxSessionDurationType";
 export { MaxSessionDurationUpdateAttributes } from "./models/MaxSessionDurationUpdateAttributes";
 export { MaxSessionDurationUpdateData } from "./models/MaxSessionDurationUpdateData";
 export { MaxSessionDurationUpdateRequest } from "./models/MaxSessionDurationUpdateRequest";
+export { McpCrossAppAccessIssuerUrlType } from "./models/McpCrossAppAccessIssuerUrlType";
+export { McpCrossAppAccessIssuerUrlUpdateAttributes } from "./models/McpCrossAppAccessIssuerUrlUpdateAttributes";
+export { McpCrossAppAccessIssuerUrlUpdateData } from "./models/McpCrossAppAccessIssuerUrlUpdateData";
+export { McpCrossAppAccessIssuerUrlUpdateRequest } from "./models/McpCrossAppAccessIssuerUrlUpdateRequest";
 export { OrgAttributes } from "./models/OrgAttributes";
 export { OrgConfigGetResponse } from "./models/OrgConfigGetResponse";
 export { OrgConfigListResponse } from "./models/OrgConfigListResponse";

services/organizations/src/v2/models/McpCrossAppAccessIssuerUrlType.ts

@@ -0,0 +1,7 @@
+import { UnparsedObject } from "@datadog/datadog-api-client";
+
+/**
+ * Data type of an MCP Cross-App Access issuer URL update.
+ */
+export type McpCrossAppAccessIssuerUrlType = typeof ORG_CONFIG | UnparsedObject;
+export const ORG_CONFIG = "org_config";