---
title: "Search App Resources"
method: POST
path: "/api/v1/search/app_resources"
tags: ["App Resource"]
---

# Search App Resources

`POST /api/v1/search/app_resources`

Search app resources based on filters specified in the request body.

## Request body

- C1ApiAppV1SearchAppResourcesRequest — Search app resources based on filters specified in the request body.
  - `appId` string — The app ID to restrict the search to.
  - `appUserIds` string[], nullable — A list of app user IDs to restrict the search by.
  - `excludeDeletedResourceBindings` boolean — If true, exclude resources whose bindings have been deleted.
  - `excludeResourceIds` string[], nullable — A list of resource IDs to exclude from the search results.
  - `excludeResourceTypeTraitIds` string[], nullable — A list of resource type trait IDs to exclude from the search.
  - `ownerUserIds` string[], nullable — A list of C1 user IDs to filter resources by ownership.
  - `pageSize` integer — The maximum number of results to return per page.
  - `pageToken` string — The token for fetching the next page of results.
  - `query` string — Fuzzy search the display name of resources.
  - `refs` C1ApiAppV1AppResourceRef[], nullable — A list of specific app resource references to restrict the search to.
    - `appId` string — The ID of the app that owns the resource.
    - `appResourceTypeId` string — The ID of the resource type that classifies this resource.
    - `id` string — The unique ID of the app resource.
  - `resourceIds` string[], nullable — A list of resource IDs to restrict the search to.
  - `resourceTypeIds` string[], nullable — A list of resource type IDs to restrict the search by.
  - `resourceTypeTraitIds` string[], nullable — A list of resource type trait IDs to restrict the search by.

## Response `200`

The SearchAppResourcesResponse message contains a list of results and a nextPageToken if applicable.

- C1ApiAppV1SearchAppResourcesResponse — The SearchAppResourcesResponse message contains a list of results and a nextPageToken if applicable.
  - `expanded` object[], nullable — List of serialized related objects.
    - `@type` string — The type of the serialized message.
  - `list` C1ApiAppV1AppResourceView[], nullable — The list of app resource results.
    - `appPath` string — JSONPATH expression indicating the location of the App object in the array
    - `appResource` C1ApiAppV1AppResource — The app resource message is a single resource that can have entitlements. This message contains a oneof named metadata. Only a single field of the following list may be set at a time: - secretTrait
      - `accessConfigId` string — The access config ID for this resource. May be empty. Must be one of the builtin access config IDs or empty.
      - `annotations` object — Bounded key/value metadata bag for IaC marking and customer tags. See .rfcs/object-annotations.md §2. Limits: ≤16 entries; keys 1–128 chars matching ^[A-Za-z][A-Za-z0-9._/-]{0,127}$; values 0–256 chars URL-safe ASCII; total serialized ≤ 4096 bytes. Keys matching ^c1/ are reserved. Well-known keys: `managed_by`, `iac_workspace`, `iac_resource_address`, `iac_tool_version`. Most AppResources are connector-synced; user-supplied annotations on a synced resource will be overwritten by the next sync. The annotations bag is most useful on user-created groups (the `conductorone_app_resource` TF resource).
      - `appId` string — The app that this resource belongs to.
      - `appResourceTypeId` string — The resource type that this resource is.
      - `createdAt` string, date-time
      - `customDescription` string — A custom description that can be set for a resource.
      - `deletedAt` string, date-time
      - `description` string — The description set for the resource.
      - `displayName` string — The display name for this resource.
      - `externalId` string — The upstream product's native external ID for this resource (e.g. an Okta group ID). Populated from the connector's external ID during sync.
      - `grantCount` string, int64 — The number of grants to this resource.
      - `id` string — The id of the resource.
      - `matchBatonId` string — The matchBatonId field.
      - `parentAppResourceId` string — The parent resource id, if this resource is a child of another resource.
      - `parentAppResourceTypeId` string — The parent resource type id, if this resource is a child of another resource.
      - `profile` object
      - `secretTrait` C1ApiAppV1SecretTrait, nullable — The SecretTrait message.
        - `identityAppUserId` string — The identityAppUserId field.
        - `lastUsedAt` string, date-time
        - `secretCreatedAt` string, date-time
        - `secretExpiresAt` string, date-time
      - `updatedAt` string, date-time
    - `objectPermissions` C1ApiIamV1ActorObjectPermissions — The ActorObjectPermissions message.
      - `delete` boolean — The delete field.
      - `edit` boolean — The edit field.
      - `extra` object — The extra field.
      - `read` boolean — The read field.
    - `parentResourcePath` string — JSONPATH expression indicating the location of the Parent Resource object in the array
    - `parentResourceTypePath` string — JSONPATH expression indicating the location of the Parent Resource Type object in the array
    - `resourceTypePath` string — JSONPATH expression indicating the location of the Resource Type object in the array
  - `nextPageToken` string — The token for fetching the next page of results.

---

[API](https://skmtc.net/conductorone/apis/c1-api.md) · [All operations](https://skmtc.net/conductorone/apis/c1-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/conductorone/c1-api/revisions/d391405a35d3/schema)