---
title: "Search"
method: POST
path: "/api/v1/search/sign-in-policies"
tags: ["Sign-In Policy"]
---

# Search

`POST /api/v1/search/sign-in-policies`

Search sign-in policies by name, or fetch a specific set by ID. Returns
 one page of matching policies at a time.

## Request body

- C1ApiSignInPolicyV1SignInPolicyServiceSearchRequest — The SignInPolicyServiceSearchRequest message.
  - `pageSize` integer — The maximum number of results to return per page.
  - `pageToken` string — A pagination token from a previous Search response.
  - `query` string — Free-text search over the policy name. Empty matches all policies.
  - `refs` C1ApiSignInPolicyV1SignInPolicyRef[], nullable — Restrict results to these specific policies. Empty matches all policies.
    - `id` string — The id field.

## Response `200`

Successful response

- C1ApiSignInPolicyV1SignInPolicyServiceSearchResponse — The SignInPolicyServiceSearchResponse message.
  - `list` C1ApiSignInPolicyV1SignInPolicy[], nullable — The page of matching policies.
    - `allowedMfaTypes` string[], nullable — The credential types accepted as a second factor. Must be a subset of the credential types their inventory policy permits.
    - `allowedPrimaryTypes` string[], nullable — The primary credential types users may sign in with. Must be a subset of the credential types their inventory policy permits.
    - `createdAt` string, date-time, nullable
    - `defaultOutcome` C1ApiSignInPolicyV1PolicyOutcome — PolicyOutcome is the effect of a matched rule. Exactly one kind is set. This message contains a oneof named kind. Only a single field of the following list may be set at a time: - allow - deny - stepUpRequired - challengeRequired - enrollmentRequired
      - `allow` C1ApiSignInPolicyV1Allow — Allow permits the sign-in.
        - `floorLevel` 'AUTH_LEVEL_UNSPECIFIED' | 'AUTH_LEVEL_NONE' | 'AUTH_LEVEL_SINGLE_FACTOR' | 'AUTH_LEVEL_MULTI_FACTOR' | 'AUTH_LEVEL_PHR' | 'AUTH_LEVEL_PHRH' — The minimum assurance level that satisfies this rule. Required on enforced Allow rules.
      - `challengeRequired` C1ApiSignInPolicyV1ChallengeRequired — ChallengeRequired asks for an additional factor before the sign-in completes.
        - `types` string[], nullable — The credential types that may satisfy the challenge.
      - `deny` C1ApiSignInPolicyV1Deny — Deny rejects the sign-in.
        - `reasonAdmin` string — Reason shown in admin-only audit.
        - `reasonUser` string — Reason safe to show the end user.
      - `enrollmentRequired` C1ApiSignInPolicyV1EnrollmentRequired — EnrollmentRequired tells the user to enroll a credential before continuing.
        - `credentialTypes` string[], nullable — The credential types the user may enroll. Empty means "complete identity verification first".
      - `stepUpRequired` C1ApiSignInPolicyV1StepUpRequired — StepUpRequired demands a stronger re-authentication before access is granted.
        - `level` 'AUTH_LEVEL_UNSPECIFIED' | 'AUTH_LEVEL_NONE' | 'AUTH_LEVEL_SINGLE_FACTOR' | 'AUTH_LEVEL_MULTI_FACTOR' | 'AUTH_LEVEL_PHR' | 'AUTH_LEVEL_PHRH' — The assurance level the step-up must reach.
        - `maxAgeSeconds` integer — How fresh the step-up must be, in seconds.
        - `types` string[], nullable — The credential types that may satisfy the step-up.
    - `deletedAt` string, date-time, nullable
    - `displayName` string — A human-readable name for the policy.
    - `id` string — Unique identifier for the policy.
    - `isBuiltin` boolean — True for built-in policies provided by ConductorOne. Built-in policies cannot be edited or deleted.
    - `priority` integer — When a user matches more than one policy, the policy with the highest priority applies.
    - `rules` C1ApiSignInPolicyV1PolicyRule[], nullable — The ordered rule cascade, evaluated top to bottom.
      - `description` string — A human-readable description shown in the admin UI.
      - `id` string — A stable identifier for the rule, surfaced in audit.
      - `matchCel` string — A boolean condition expression evaluated against the sign-in context.
      - `mode` 'POLICY_RULE_MODE_UNSPECIFIED' | 'POLICY_RULE_MODE_ENFORCE' | 'POLICY_RULE_MODE_OBSERVE' | 'POLICY_RULE_MODE_DISABLED' — Whether the rule is live, evaluated-only, or skipped.
      - `outcome` C1ApiSignInPolicyV1PolicyOutcome — PolicyOutcome is the effect of a matched rule. Exactly one kind is set. This message contains a oneof named kind. Only a single field of the following list may be set at a time: - allow - deny - stepUpRequired - challengeRequired - enrollmentRequired
        - `allow` C1ApiSignInPolicyV1Allow — Allow permits the sign-in.
          - `floorLevel` 'AUTH_LEVEL_UNSPECIFIED' | 'AUTH_LEVEL_NONE' | 'AUTH_LEVEL_SINGLE_FACTOR' | 'AUTH_LEVEL_MULTI_FACTOR' | 'AUTH_LEVEL_PHR' | 'AUTH_LEVEL_PHRH' — The minimum assurance level that satisfies this rule. Required on enforced Allow rules.
        - `challengeRequired` C1ApiSignInPolicyV1ChallengeRequired — ChallengeRequired asks for an additional factor before the sign-in completes.
          - `types` string[], nullable — The credential types that may satisfy the challenge.
        - `deny` C1ApiSignInPolicyV1Deny — Deny rejects the sign-in.
          - `reasonAdmin` string — Reason shown in admin-only audit.
          - `reasonUser` string — Reason safe to show the end user.
        - `enrollmentRequired` C1ApiSignInPolicyV1EnrollmentRequired — EnrollmentRequired tells the user to enroll a credential before continuing.
          - `credentialTypes` string[], nullable — The credential types the user may enroll. Empty means "complete identity verification first".
        - `stepUpRequired` C1ApiSignInPolicyV1StepUpRequired — StepUpRequired demands a stronger re-authentication before access is granted.
          - `level` 'AUTH_LEVEL_UNSPECIFIED' | 'AUTH_LEVEL_NONE' | 'AUTH_LEVEL_SINGLE_FACTOR' | 'AUTH_LEVEL_MULTI_FACTOR' | 'AUTH_LEVEL_PHR' | 'AUTH_LEVEL_PHRH' — The assurance level the step-up must reach.
          - `maxAgeSeconds` integer — How fresh the step-up must be, in seconds.
          - `types` string[], nullable — The credential types that may satisfy the step-up.
    - `updatedAt` string, date-time, nullable
  - `nextPageToken` string — A token to fetch the next page, or empty if there are no more results.

---

[API](https://skmtc.net/conductorone/apis/c1-api.md) · [All operations](https://skmtc.net/conductorone/apis/c1-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/conductorone/c1-api/revisions/f2cf3228f366/schema)