---
title: "Search"
method: POST
path: "/api/v1/decoys/search"
tags: ["Decoy"]
---

# Search

`POST /api/v1/decoys/search`

Search decoys with free-text query and filters for kind, status,
 and annotation key.

## Request body

- C1ApiDecoyV1DecoySearchRequest — The DecoySearchRequest message.
  - `annotationKeys` string[], nullable — Filter to decoys that have at least one of these annotation keys set. Empty means no annotation filter. Per-key constraints match the c1api annotation-bag standard (min_len 1, max_len 128, same regex used by every annotation-bag-typed field across c1api).
  - `hasBeenUsed` boolean — Filter to decoys that have been used at least once. False / unset means no filter (show all). The "never used" case is not covered in this filter; add an explicit field if needed.
  - `kinds` string[], nullable — Filter by kind (OR within the list). Empty means any kind.
  - `pageSize` integer — The pageSize field.
  - `pageToken` string — The pageToken field.
  - `query` string — Free-text query against display_name and description. Empty means no text filter.
  - `statuses` string[], nullable — Filter by status (OR within the list). Empty means any status.

## Response `200`

Successful response

- C1ApiDecoyV1DecoySearchResponse — The DecoySearchResponse message.
  - `list` C1ApiDecoyV1Decoy[], nullable — The list field.
    - `annotations` object — Customer-defined grouping/filtering bag. PATCH semantics on Update: keys in the request overwrite, keys missing stay, keys set to empty string delete. Copied onto the Finding produced when a decoy fires, so routing rules can condition on the same keys.
    - `createdAt` string, date-time, nullable
    - `description` string — The description field.
    - `disabled` boolean — Admin-disabled.
    - `displayName` string — The displayName field.
    - `id` string — The id field.
    - `kind` 'DECOY_KIND_UNSPECIFIED' | 'DECOY_KIND_USER_CLIENT_CREDENTIAL' | 'DECOY_KIND_CONNECTOR_CLIENT' | 'DECOY_KIND_WORKLOAD_FEDERATION' | 'DECOY_KIND_ACCESS_TOKEN' — The kind field.
    - `lastUsedAt` string, date-time, nullable
    - `materialFingerprintSha256` string — Hex-encoded SHA256 of the secret string vended at Create / Rotate. Stable for the decoy's current material; changes only on Rotate. Empty for WorkloadFederation decoys (no server-vended secret).
    - `updatedAt` string, date-time, nullable
  - `nextPageToken` string — The nextPageToken field.

---

[API](https://skmtc.net/conductorone/apis/c1-api.md) · [All operations](https://skmtc.net/conductorone/apis/c1-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/conductorone/c1-api/revisions/f2cf3228f366/schema)