add MCP Cross-App Access issuer URL endpoint to public API spec

.generator/schemas/v2/openapi.yaml

@@ -60208,6 +60208,41 @@ components:
           $ref: "#/components/schemas/MaxSessionDurationUpdateData"
       required: [data]
       type: object
+    McpCrossAppAccessIssuerUrlType:
+      description: Data type of an MCP Cross-App Access issuer URL update.
+      enum: [org_config]
+      example: org_config
+      type: string
+      x-enum-varnames:
+        - ORG_CONFIG
+    McpCrossAppAccessIssuerUrlUpdateAttributes:
+      description: Attributes for the MCP Cross-App Access issuer URL update request.
+      properties:
+        issuer_url:
+          description: |-
+            The Okta OIDC issuer URL for MCP Cross-App Access, for example
+            `https://your-subdomain.okta.com`. Provide an empty string to unset
+            the issuer URL and opt the organization out of MCP Cross-App Access.
+          example: https://your-subdomain.okta.com
+          type: string
+      required: [issuer_url]
+      type: object
+    McpCrossAppAccessIssuerUrlUpdateData:
+      description: The data object for an MCP Cross-App Access issuer URL update request.
+      properties:
+        attributes:
+          $ref: "#/components/schemas/McpCrossAppAccessIssuerUrlUpdateAttributes"
+        type:
+          $ref: "#/components/schemas/McpCrossAppAccessIssuerUrlType"
+      required: [type, attributes]
+      type: object
+    McpCrossAppAccessIssuerUrlUpdateRequest:
+      description: A request to update the MCP Cross-App Access issuer URL for an organization.
+      properties:
+        data:
+          $ref: "#/components/schemas/McpCrossAppAccessIssuerUrlUpdateData"
+      required: [data]
+      type: object
     McpScanRequest:
       description: The top-level request object for submitting an MCP SCA dependency scan.
       properties:
@@ -154159,6 +154194,52 @@ paths:
         operator: OR
         permissions:
           - org_management
+  /api/v2/login/org_configs/mcp_cross_app_access_issuer_url:
+    put:
+      description: |-
+        Update the Okta OIDC issuer URL used for MCP Cross-App Access (XAA)
+        for the current organization. The URL must be a bare Okta issuer such
+        as `https://your-subdomain.okta.com` (no path, port, query, or fragment).
+        Provide an empty string to unset the issuer URL and opt the organization
+        out of MCP Cross-App Access.
+      operationId: UpdateLoginOrgConfigsMcpCrossAppAccessIssuerUrl
+      requestBody:
+        content:
+          application/json:
+            examples:
+              default:
+                value:
+                  data:
+                    attributes:
+                      issuer_url: https://your-subdomain.okta.com
+                    type: org_config
+            schema:
+              $ref: "#/components/schemas/McpCrossAppAccessIssuerUrlUpdateRequest"
+        required: true
+      responses:
+        "204":
+          description: No Content
+        "400":
+          $ref: "#/components/responses/BadRequestResponse"
+        "401":
+          $ref: "#/components/responses/UnauthorizedResponse"
+        "403":
+          $ref: "#/components/responses/ForbiddenResponse"
+        "429":
+          $ref: "#/components/responses/TooManyRequestsResponse"
+      security:
+        - apiKeyAuth: []
+          appKeyAuth: []
+        - AuthZ:
+            - org_management
+      summary: Update the MCP Cross-App Access issuer URL
+      tags: [Organizations]
+      "x-permission":
+        operator: OR
+        permissions:
+          - org_management
+      x-unstable: |-
+        **Note**: This endpoint is in Preview and may change in the future. It is not yet recommended for production use.
   /api/v2/logs:
     post:
       description: |-

examples/v2/organizations/UpdateLoginOrgConfigsMcpCrossAppAccessIssuerUrl.java

@@ -0,0 +1,39 @@
+// Update the MCP Cross-App Access issuer URL returns "No Content" response
+
+import com.datadog.api.client.ApiClient;
+import com.datadog.api.client.ApiException;
+import com.datadog.api.client.v2.api.OrganizationsApi;
+import com.datadog.api.client.v2.model.McpCrossAppAccessIssuerUrlType;
+import com.datadog.api.client.v2.model.McpCrossAppAccessIssuerUrlUpdateAttributes;
+import com.datadog.api.client.v2.model.McpCrossAppAccessIssuerUrlUpdateData;
+import com.datadog.api.client.v2.model.McpCrossAppAccessIssuerUrlUpdateRequest;
+
+public class Example {
+  public static void main(String[] args) {
+    ApiClient defaultClient = ApiClient.getDefaultApiClient();
+    defaultClient.setUnstableOperationEnabled(
+        "v2.updateLoginOrgConfigsMcpCrossAppAccessIssuerUrl", true);
+    OrganizationsApi apiInstance = new OrganizationsApi(defaultClient);
+
+    McpCrossAppAccessIssuerUrlUpdateRequest body =
+        new McpCrossAppAccessIssuerUrlUpdateRequest()
+            .data(
+                new McpCrossAppAccessIssuerUrlUpdateData()
+                    .attributes(
+                        new McpCrossAppAccessIssuerUrlUpdateAttributes()
+                            .issuerUrl("https://your-subdomain.okta.com"))
+                    .type(McpCrossAppAccessIssuerUrlType.ORG_CONFIG));
+
+    try {
+      apiInstance.updateLoginOrgConfigsMcpCrossAppAccessIssuerUrl(body);
+    } catch (ApiException e) {
+      System.err.println(
+          "Exception when calling"
+              + " OrganizationsApi#updateLoginOrgConfigsMcpCrossAppAccessIssuerUrl");
+      System.err.println("Status code: " + e.getCode());
+      System.err.println("Reason: " + e.getResponseBody());
+      System.err.println("Response headers: " + e.getResponseHeaders());
+      e.printStackTrace();
+    }
+  }
+}

src/main/java/com/datadog/api/client/ApiClient.java

@@ -1064,6 +1064,7 @@ public class ApiClient {
           put("v2.updateForm", false);
           put("v2.upsertAndPublishFormVersion", false);
           put("v2.upsertFormVersion", false);
+          put("v2.updateLoginOrgConfigsMcpCrossAppAccessIssuerUrl", false);
           put("v2.updateOrgSamlConfigurations", false);
           put("v2.getGovernanceControl", false);
           put("v2.listGovernanceControls", false);

src/main/java/com/datadog/api/client/v2/api/OrganizationsApi.java

@@ -9,6 +9,7 @@
 import com.datadog.api.client.v2.model.GlobalOrgsResponse;
 import com.datadog.api.client.v2.model.ManagedOrgsResponse;
 import com.datadog.api.client.v2.model.MaxSessionDurationUpdateRequest;
+import com.datadog.api.client.v2.model.McpCrossAppAccessIssuerUrlUpdateRequest;
 import com.datadog.api.client.v2.model.OrgConfigGetResponse;
 import com.datadog.api.client.v2.model.OrgConfigListResponse;
 import com.datadog.api.client.v2.model.OrgConfigWriteRequest;
@@ -1137,6 +1138,164 @@ public ApiResponse<Void> updateLoginOrgConfigsMaxSessionDurationWithHttpInfo(
         null);
   }
 
+  /**
+   * Update the MCP Cross-App Access issuer URL.
+   *
+   * <p>See {@link #updateLoginOrgConfigsMcpCrossAppAccessIssuerUrlWithHttpInfo}.
+   *
+   * @param body (required)
+   * @throws ApiException if fails to make API call
+   */
+  public void updateLoginOrgConfigsMcpCrossAppAccessIssuerUrl(
+      McpCrossAppAccessIssuerUrlUpdateRequest body) throws ApiException {
+    updateLoginOrgConfigsMcpCrossAppAccessIssuerUrlWithHttpInfo(body);
+  }
+
+  /**
+   * Update the MCP Cross-App Access issuer URL.
+   *
+   * <p>See {@link #updateLoginOrgConfigsMcpCrossAppAccessIssuerUrlWithHttpInfoAsync}.
+   *
+   * @param body (required)
+   * @return CompletableFuture
+   */
+  public CompletableFuture<Void> updateLoginOrgConfigsMcpCrossAppAccessIssuerUrlAsync(
+      McpCrossAppAccessIssuerUrlUpdateRequest body) {
+    return updateLoginOrgConfigsMcpCrossAppAccessIssuerUrlWithHttpInfoAsync(body)
+        .thenApply(
+            response -> {
+              return response.getData();
+            });
+  }
+
+  /**
+   * Update the Okta OIDC issuer URL used for MCP Cross-App Access (XAA) for the current
+   * organization. The URL must be a bare Okta issuer such as <code>https://your-subdomain.okta.com
+   * </code> (no path, port, query, or fragment). Provide an empty string to unset the issuer URL
+   * and opt the organization out of MCP Cross-App Access.
+   *
+   * @param body (required)
+   * @return ApiResponse&lt;Void&gt;
+   * @throws ApiException if fails to make API call
+   * @http.response.details
+   *     <table border="1">
+   *    <caption>Response details</caption>
+   *       <tr><td> Status Code </td><td> Description </td><td> Response Headers </td></tr>
+   *       <tr><td> 204 </td><td> No Content </td><td>  -  </td></tr>
+   *       <tr><td> 400 </td><td> Bad Request </td><td>  -  </td></tr>
+   *       <tr><td> 401 </td><td> Unauthorized </td><td>  -  </td></tr>
+   *       <tr><td> 403 </td><td> Forbidden </td><td>  -  </td></tr>
+   *       <tr><td> 429 </td><td> Too many requests </td><td>  -  </td></tr>
+   *     </table>
+   */
+  public ApiResponse<Void> updateLoginOrgConfigsMcpCrossAppAccessIssuerUrlWithHttpInfo(
+      McpCrossAppAccessIssuerUrlUpdateRequest body) throws ApiException {
+    // Check if unstable operation is enabled
+    String operationId = "updateLoginOrgConfigsMcpCrossAppAccessIssuerUrl";
+    if (apiClient.isUnstableOperationEnabled("v2." + operationId)) {
+      apiClient.getLogger().warning(String.format("Using unstable operation '%s'", operationId));
+    } else {
+      throw new ApiException(0, String.format("Unstable operation '%s' is disabled", operationId));
+    }
+    Object localVarPostBody = body;
+
+    // verify the required parameter 'body' is set
+    if (body == null) {
+      throw new ApiException(
+          400,
+          "Missing the required parameter 'body' when calling"
+              + " updateLoginOrgConfigsMcpCrossAppAccessIssuerUrl");
+    }
+    // create path and map variables
+    String localVarPath = "/api/v2/login/org_configs/mcp_cross_app_access_issuer_url";
+
+    Map<String, String> localVarHeaderParams = new HashMap<String, String>();
+
+    Invocation.Builder builder =
+        apiClient.createBuilder(
+            "v2.OrganizationsApi.updateLoginOrgConfigsMcpCrossAppAccessIssuerUrl",
+            localVarPath,
+            new ArrayList<Pair>(),
+            localVarHeaderParams,
+            new HashMap<String, String>(),
+            new String[] {"*/*"},
+            new String[] {"apiKeyAuth", "appKeyAuth", "AuthZ"});
+    return apiClient.invokeAPI(
+        "PUT",
+        builder,
+        localVarHeaderParams,
+        new String[] {"application/json"},
+        localVarPostBody,
+        new HashMap<String, Object>(),
+        false,
+        null);
+  }
+
+  /**
+   * Update the MCP Cross-App Access issuer URL.
+   *
+   * <p>See {@link #updateLoginOrgConfigsMcpCrossAppAccessIssuerUrlWithHttpInfo}.
+   *
+   * @param body (required)
+   * @return CompletableFuture&lt;ApiResponse&lt;Void&gt;&gt;
+   */
+  public CompletableFuture<ApiResponse<Void>>
+      updateLoginOrgConfigsMcpCrossAppAccessIssuerUrlWithHttpInfoAsync(
+          McpCrossAppAccessIssuerUrlUpdateRequest body) {
+    // Check if unstable operation is enabled
+    String operationId = "updateLoginOrgConfigsMcpCrossAppAccessIssuerUrl";
+    if (apiClient.isUnstableOperationEnabled("v2." + operationId)) {
+      apiClient.getLogger().warning(String.format("Using unstable operation '%s'", operationId));
+    } else {
+      CompletableFuture<ApiResponse<Void>> result = new CompletableFuture<>();
+      result.completeExceptionally(
+          new ApiException(0, String.format("Unstable operation '%s' is disabled", operationId)));
+      return result;
+    }
+    Object localVarPostBody = body;
+
+    // verify the required parameter 'body' is set
+    if (body == null) {
+      CompletableFuture<ApiResponse<Void>> result = new CompletableFuture<>();
+      result.completeExceptionally(
+          new ApiException(
+              400,
+              "Missing the required parameter 'body' when calling"
+                  + " updateLoginOrgConfigsMcpCrossAppAccessIssuerUrl"));
+      return result;
+    }
+    // create path and map variables
+    String localVarPath = "/api/v2/login/org_configs/mcp_cross_app_access_issuer_url";
+
+    Map<String, String> localVarHeaderParams = new HashMap<String, String>();
+
+    Invocation.Builder builder;
+    try {
+      builder =
+          apiClient.createBuilder(
+              "v2.OrganizationsApi.updateLoginOrgConfigsMcpCrossAppAccessIssuerUrl",
+              localVarPath,
+              new ArrayList<Pair>(),
+              localVarHeaderParams,
+              new HashMap<String, String>(),
+              new String[] {"*/*"},
+              new String[] {"apiKeyAuth", "appKeyAuth", "AuthZ"});
+    } catch (ApiException ex) {
+      CompletableFuture<ApiResponse<Void>> result = new CompletableFuture<>();
+      result.completeExceptionally(ex);
+      return result;
+    }
+    return apiClient.invokeAPIAsync(
+        "PUT",
+        builder,
+        localVarHeaderParams,
+        new String[] {"application/json"},
+        localVarPostBody,
+        new HashMap<String, Object>(),
+        false,
+        null);
+  }
+
   /**
    * Update a specific Org Config.
    *

src/main/java/com/datadog/api/client/v2/model/McpCrossAppAccessIssuerUrlType.java

@@ -0,0 +1,57 @@
+/*
+ * Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.
+ * This product includes software developed at Datadog (https://www.datadoghq.com/).
+ * Copyright 2019-Present Datadog, Inc.
+ */
+
+package com.datadog.api.client.v2.model;
+
+import com.datadog.api.client.ModelEnum;
+import com.fasterxml.jackson.annotation.JsonCreator;
+import com.fasterxml.jackson.core.JsonGenerator;
+import com.fasterxml.jackson.core.JsonProcessingException;
+import com.fasterxml.jackson.databind.SerializerProvider;
+import com.fasterxml.jackson.databind.annotation.JsonSerialize;
+import com.fasterxml.jackson.databind.ser.std.StdSerializer;
+import java.io.IOException;
+import java.util.Arrays;
+import java.util.HashSet;
+import java.util.Set;
+
+/** Data type of an MCP Cross-App Access issuer URL update. */
+@JsonSerialize(
+    using = McpCrossAppAccessIssuerUrlType.McpCrossAppAccessIssuerUrlTypeSerializer.class)
+public class McpCrossAppAccessIssuerUrlType extends ModelEnum<String> {
+
+  private static final Set<String> allowedValues = new HashSet<String>(Arrays.asList("org_config"));
+
+  public static final McpCrossAppAccessIssuerUrlType ORG_CONFIG =
+      new McpCrossAppAccessIssuerUrlType("org_config");
+
+  McpCrossAppAccessIssuerUrlType(String value) {
+    super(value, allowedValues);
+  }
+
+  public static class McpCrossAppAccessIssuerUrlTypeSerializer
+      extends StdSerializer<McpCrossAppAccessIssuerUrlType> {
+    public McpCrossAppAccessIssuerUrlTypeSerializer(Class<McpCrossAppAccessIssuerUrlType> t) {
+      super(t);
+    }
+
+    public McpCrossAppAccessIssuerUrlTypeSerializer() {
+      this(null);
+    }
+
+    @Override
+    public void serialize(
+        McpCrossAppAccessIssuerUrlType value, JsonGenerator jgen, SerializerProvider provider)
+        throws IOException, JsonProcessingException {
+      jgen.writeObject(value.value);
+    }
+  }
+
+  @JsonCreator
+  public static McpCrossAppAccessIssuerUrlType fromValue(String value) {
+    return new McpCrossAppAccessIssuerUrlType(value);
+  }
+}