From aa326189cfc2b8efa4a28d3db393ef97f9652f62 Mon Sep 17 00:00:00 2001
From: Anne Erdtsieck <anne.erdtsieck@topicus.nl>
Date: Fri, 4 Sep 2026 12:29:40 +0200
Subject: [PATCH 1/2] fix: derive is_system from the existing resource server
 on update

stripUpdateFields removes is_system before updateResourceServer runs, so the
guard only ever matched the hardcoded Auth0 My Account API name. Any other
system resource server was sent a full update including name, which the
Management API rejects.
---
 src/tools/auth0/handlers/resourceServers.ts | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/src/tools/auth0/handlers/resourceServers.ts b/src/tools/auth0/handlers/resourceServers.ts
index 7f87d1e3a..6b8d238af 100644
--- a/src/tools/auth0/handlers/resourceServers.ts
+++ b/src/tools/auth0/handlers/resourceServers.ts
@@ -199,8 +199,13 @@ export default class ResourceServersHandler extends DefaultHandler {
     id: string,
     update: ResourceServer
   ): Promise<Management.UpdateResourceServerResponseContent> {
-    // Exclude name from update as it cannot be modified for system resource servers like Auth0 My Account API
-    if (update.is_system === true || update.name === 'Auth0 My Account API') {
+    // Exclude name from update as it cannot be modified for system resource servers like the
+    // Auth0 My Account API or the Auth0 My Organization API. `is_system` is listed in
+    // `stripUpdateFields`, so it has already been removed from `update` by the time this runs -
+    // read it off the existing resource server instead, which `getType()` retains it on.
+    const existing = this.existing?.find((resourceServer) => resourceServer.id === id);
+
+    if (existing?.is_system === true) {
       const updateFields: Management.UpdateResourceServerRequestContent = {
         token_lifetime: update.token_lifetime,
         proof_of_possession: update.proof_of_possession,

From 561c794f8032210205c80fc840aa11a2fdc90f9d Mon Sep 17 00:00:00 2001
From: Anne Erdtsieck <anne.erdtsieck@topicus.nl>
Date: Fri, 4 Sep 2026 12:30:09 +0200
Subject: [PATCH 2/2] test: cover a system resource server other than the My
 Account API

---
 .../auth0/handlers/resourceServers.tests.js   | 42 +++++++++++++++++++
 1 file changed, 42 insertions(+)

diff --git a/test/tools/auth0/handlers/resourceServers.tests.js b/test/tools/auth0/handlers/resourceServers.tests.js
index 45cbff6f5..54752be79 100644
--- a/test/tools/auth0/handlers/resourceServers.tests.js
+++ b/test/tools/auth0/handlers/resourceServers.tests.js
@@ -964,5 +964,47 @@ describe('#resourceServers handler', () => {
       await stageFn.apply(handler, [data]);
       expect(updateCalled).to.equal(true);
     });
+
+    it('should update a system resource server other than "Auth0 My Account API" without name', async () => {
+      let updateCalled = false;
+      const existingResourceServer = {
+        id: 'rs_my_organization',
+        identifier: 'https://auth0.com/my-organization/my-org/',
+        name: 'Auth0 My Organization API',
+        is_system: true,
+      };
+
+      const auth0 = {
+        resourceServers: {
+          create: () => Promise.resolve({ data: [] }),
+          update: function (id, data) {
+            updateCalled = true;
+            expect(id).to.equal('rs_my_organization');
+            expect(data.name).to.equal(undefined);
+            expect(data.is_system).to.equal(undefined);
+            expect(data.token_lifetime).to.equal(600);
+            return Promise.resolve({ data });
+          },
+          delete: () => Promise.resolve({ data: [] }),
+          list: (params) => mockPagedData(params, 'resource_servers', [existingResourceServer]),
+        },
+        pool,
+      };
+
+      const handler = new resourceServers.default({ client: pageClient(auth0), config });
+      const stageFn = Object.getPrototypeOf(handler).processChanges;
+      const data = {
+        resourceServers: [
+          {
+            name: 'Auth0 My Organization API',
+            identifier: 'https://auth0.com/my-organization/my-org/',
+            token_lifetime: 600,
+          },
+        ],
+      };
+
+      await stageFn.apply(handler, [data]);
+      expect(updateCalled).to.equal(true);
+    });
   });
 });