---
title: "Search"
method: POST
path: "/api/v1/search/xaa/access_profile_scope_bindings"
tags: ["Cross-App Access"]
---

# Search

`POST /api/v1/search/xaa/access_profile_scope_bindings`

Search scope bindings, filtered by access profile or by scope, or fetch a
 specific set by ref. The by-scope direction answers "which profiles
 contain this scope" for impact analysis.

## Request body

- C1ApiCrossAppAccessV1XAAAccessProfileScopeBindingServiceSearchRequest — XAAAccessProfileScopeBindingServiceSearchRequest searches scope bindings.
  - `accessProfileIds` string[], nullable — Optional filter by access profiles. Empty matches any access profile.
  - `appId` string — The application that owns the resource server (required).
  - `pageSize` integer — Page size (max 100).
  - `pageToken` string — Page token for pagination.
  - `refs` C1ApiCrossAppAccessV1XAAAccessProfileScopeBindingRef[], nullable — Optional: fetch a specific set of bindings by ref (used by websocket notify to re-fetch individual rows).
    - `accessProfileId` string — The accessProfileId field.
    - `appId` string — The appId field.
    - `xaaScopeId` string — The xaaScopeId field.
  - `xaaScopeIds` string[], nullable — Optional filter by scopes (impact analysis: which profiles contain a scope). Empty matches any scope.

## Response `200`

XAAAccessProfileScopeBindingServiceSearchResponse returns matching bindings.

- C1ApiCrossAppAccessV1XAAAccessProfileScopeBindingServiceSearchResponse — XAAAccessProfileScopeBindingServiceSearchResponse returns matching bindings.
  - `list` C1ApiCrossAppAccessV1XAAAccessProfileScopeBinding[], nullable — Matching scope bindings.
    - `accessProfileId` string — The access profile end of the binding.
    - `appId` string — The application that owns the resource server.
    - `createdAt` string, date-time, nullable
    - `deletedAt` string, date-time, nullable
    - `updatedAt` string, date-time, nullable
    - `xaaResourceServerId` string — The resource server both ends belong to.
    - `xaaScopeId` string — The scope end of the binding.
  - `nextPageToken` string — Token for the next page.

---

[API](https://skmtc.net/conductorone/apis/c1-api.md) · [All operations](https://skmtc.net/conductorone/apis/c1-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/conductorone/c1-api/revisions/f2cf3228f366/schema)