---
title: "Search"
method: POST
path: "/api/v1/search/xaa/access_profiles"
tags: ["Cross-App Access"]
---

# Search

`POST /api/v1/search/xaa/access_profiles`

Search access profiles across the tenant, filtered by application,
 resource server, or text query, or fetch a specific set by ref.

## Request body

- C1ApiCrossAppAccessV1XAAAccessProfileServiceSearchRequest — XAAAccessProfileServiceSearchRequest searches access profiles with filters.
  - `appIds` string[], nullable — Optional filter by applications. Empty matches any application.
  - `pageSize` integer — Page size (max 100).
  - `pageToken` string — Page token for pagination.
  - `query` string — Optional text query matched against display_name.
  - `refs` C1ApiCrossAppAccessV1XAAAccessProfileRef[], nullable — Optional: fetch a specific set of access profiles by ref (used by websocket notify to re-fetch individual rows).
    - `appId` string — The appId field.
    - `id` string — The id field.
  - `xaaResourceServerIds` string[], nullable — Optional filter by resource servers. Empty matches any resource server.

## Response `200`

XAAAccessProfileServiceSearchResponse returns matching access profiles.

- C1ApiCrossAppAccessV1XAAAccessProfileServiceSearchResponse — XAAAccessProfileServiceSearchResponse returns matching access profiles.
  - `list` C1ApiCrossAppAccessV1XAAAccessProfile[], nullable — Matching access profiles.
    - `appEntitlementId` string — The AppEntitlement created for this profile.
    - `appId` string — The application that owns the resource server.
    - `createdAt` string, date-time, nullable
    - `deletedAt` string, date-time, nullable
    - `description` string — Description of what access this profile grants.
    - `displayName` string — Display name for the profile.
    - `id` string — Unique identifier for this access profile.
    - `scopeCount` integer — The number of scopes currently bound to this profile.
    - `updatedAt` string, date-time, nullable
    - `xaaResourceServerId` string — The resource server this profile grants access to.
  - `nextPageToken` string — Token for the next page.

---

[API](https://skmtc.net/conductorone/apis/c1-api.md) · [All operations](https://skmtc.net/conductorone/apis/c1-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/conductorone/c1-api/revisions/f2cf3228f366/schema)