---
title: "Search"
method: POST
path: "/api/v1/search/xaa/client_audience_mappings"
tags: ["Cross-App Access"]
---

# Search

`POST /api/v1/search/xaa/client_audience_mappings`

Search client audience mappings across the tenant, filtered by resource
 server, disabled state, or text query, or fetch a specific set by ref.

## Request body

- C1ApiCrossAppAccessV1XAAClientAudienceMappingServiceSearchRequest — XAAClientAudienceMappingServiceSearchRequest searches mappings with filters.
  - `disabled` boolean, nullable — Optional filter by disabled state.
  - `pageSize` integer — Page size (max 100).
  - `pageToken` string — Page token for pagination.
  - `query` string — Optional text query matched against client_key and audience_client_id.
  - `refs` C1ApiCrossAppAccessV1XAAClientAudienceMappingRef[], nullable — Optional: fetch a specific set of mappings by ref (used by websocket notify to re-fetch individual rows).
    - `clientKey` string — The clientKey field.
    - `xaaResourceServerId` string — The xaaResourceServerId field.
  - `xaaResourceServerIds` string[], nullable — Optional filter by resource servers. Empty matches any resource server.

## Response `200`

XAAClientAudienceMappingServiceSearchResponse returns matching mappings.

- C1ApiCrossAppAccessV1XAAClientAudienceMappingServiceSearchResponse — XAAClientAudienceMappingServiceSearchResponse returns matching mappings.
  - `list` C1ApiCrossAppAccessV1XAAClientAudienceMapping[], nullable — Matching mappings.
    - `audienceClientId` string — The client's identifier at the resource authorization server. Stamped verbatim into the grant's client_id claim.
    - `clientKey` string — Stable client registration key. One of: a DCR client_id form (dcr://<client_id>), a CIMD client_id URL, a native C1 form (c1://<service_principal_id>), or a raw client_id.
    - `createdAt` string, date-time, nullable
    - `deletedAt` string, date-time, nullable
    - `disabled` boolean — When true, exchange requests from this client for this resource server are rejected without removing the mapping (a kill switch).
    - `updatedAt` string, date-time, nullable
    - `xaaResourceServerId` string — The resource server this mapping applies to.
  - `nextPageToken` string — Token for the next page.

---

[API](https://skmtc.net/conductorone/apis/c1-api.md) · [All operations](https://skmtc.net/conductorone/apis/c1-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/conductorone/c1-api/revisions/f2cf3228f366/schema)