--- title: "Search" method: POST path: "/api/v1/findings/search" tags: ["Findings"] --- # Search `POST /api/v1/findings/search` Search findings using full-text query and filters for severity, state, type, and app. Each Finding row is large (risk factors, evidence, target, tags) — request a small page_size (≤10) to keep responses small. ## Request body - C1ApiFindingV1FindingSearchRequest — The FindingSearchRequest message. - `appIds` string[], nullable — Filter by app IDs (OR within field). - `appResourceIds` string[], nullable — Filter by app resource IDs (OR within field). Matches findings whose target.app_resource_target.app_resource_id is in this list. An app resource is app-scoped, so pair with app_ids (and app_resource_type_ids) to hit the composite (tenant_id, app_id, app_resource_type_id, app_resource_id) index. - `appResourceTraitIds` string[], nullable — Filter to findings whose target resource's type carries any of these traits (e.g. the builtin agent / secret trait ids). OR within field; empty = not applied. - `appResourceTypeIds` string[], nullable — Filter by app resource type IDs (OR within field). Matches findings whose target.app_resource_target.app_resource_type_id is in this list. - `appUserIds` string[], nullable — Filter by app user IDs (OR within field). Matches findings whose target.app_user_target.app_user_id is in this list. - `appUserTypes` string[], nullable — Filter to findings whose target is an app user of these types (OR within field). Empty = not applied. - `connectorIds` string[], nullable — Filter by connector IDs (OR within field). Matches findings whose target.connector_target.connector_id is in this list. - `customSubTypes` string[], nullable — Filter by custom sub-type (OR within field). Matches custom findings whose custom_sub_type equals any listed value. - `decoyIds` string[], nullable — Filter by decoy IDs (OR within field). Matches findings whose target.decoy_target.decoy_id is in this list. - `findingTypes` string[], nullable — Filter by finding type (OR within field). - `includeUnassigned` boolean — When true, includes findings with no effective identity-user owner. An explicit predicate for direct API callers who prefer a bool over the "unassigned" sentinel in owner_identity_user_ids; both signals are accepted. - `nhiTypes` string[], nullable — Filter to findings whose target resource's nhi_type is one of these (OR within field). Empty = not applied; pass all NhiType values to match any nhi resource. - `ownerIdentityUserIds` string[], nullable — Filter by effective owner identity-user IDs (OR within field). Matches findings whose effective owner (assigned_owner if set, else computed_owner) resolves to an identity user in this list. The reserved "unassigned" sentinel token selects findings with no effective identity-user owner; real identity-user IDs are exactly 27 alphanumerics so the token cannot collide. - `pageSize` integer — Maximum number of findings to return per page. - `pageToken` string — Pagination token from a previous response. - `query` string — Free text search query. - `refs` C1ApiFindingV1FindingRef[], nullable — Restrict results to these finding refs by ID (OR within field). Backs the websocket-notify re-query, which refetches just the changed finding(s) to patch a row in place or detect it dropping out of the filter; empty = not applied. Hits the (tenant_id, id) primary key. - `id` string — The ID of the finding. - `scopeToAppOwner` boolean — When true, restricts results to findings for apps you own. The caller is resolved from request credentials (no user id is read from the request), so results are always limited to your own apps. - `severities` string[], nullable — Filter by severities (OR within field). - `sourceKinds` string[], nullable — Filter by source kind (OR within field). - `states` string[], nullable — Filter by states (OR within field). ## Response `200` Successful response - C1ApiFindingV1FindingSearchResponse — The FindingSearchResponse message. - `list` C1ApiFindingV1Finding[], nullable — The list field. - `annotations` object — Bounded key/value metadata bag. Limits: ≤16 entries; keys 1-128 chars matching ^[A-Za-z][A-Za-z0-9._/-]{0,127}$; values 0-256 chars; total serialized ≤4096 bytes. Keys matching ^c1/ are reserved. Also readable (and settable) via CEL as both finding.annotations and finding.custom_tags. - `appId` string — The appId field. - `appResourceTarget` C1ApiFindingV1AppResourceTarget — AppResourceTarget points at the app resource the finding is about. - `appId` string — The appId field. - `appResourceId` string — The appResourceId field. - `appResourceTypeId` string — The appResourceTypeId field. - `appUserTarget` C1ApiFindingV1AppUserTarget — The AppUserTarget message. - `appId` string — The appId field. - `appUserId` string — The appUserId field. - `assignedOwner` C1ApiFindingV1FindingOwnerRef — The FindingOwnerRef message. This message contains a oneof named owner. Only a single field of the following list may be set at a time: - identityUserId - appOwnerAppId - managerOfUserId - userSetId - `appOwnerAppId` string, nullable — The appOwnerAppId field. This field is part of the `owner` oneof. See the documentation for `c1.api.finding.v1.FindingOwnerRef` for more details. - `identityUserId` string, nullable — The identityUserId field. This field is part of the `owner` oneof. See the documentation for `c1.api.finding.v1.FindingOwnerRef` for more details. - `managerOfUserId` string, nullable — The managerOfUserId field. This field is part of the `owner` oneof. See the documentation for `c1.api.finding.v1.FindingOwnerRef` for more details. - `userSetId` string, nullable — The userSetId field. This field is part of the `owner` oneof. See the documentation for `c1.api.finding.v1.FindingOwnerRef` for more details. - `computedOwner` C1ApiFindingV1FindingOwnerRef — The FindingOwnerRef message. This message contains a oneof named owner. Only a single field of the following list may be set at a time: - identityUserId - appOwnerAppId - managerOfUserId - userSetId - `appOwnerAppId` string, nullable — The appOwnerAppId field. This field is part of the `owner` oneof. See the documentation for `c1.api.finding.v1.FindingOwnerRef` for more details. - `identityUserId` string, nullable — The identityUserId field. This field is part of the `owner` oneof. See the documentation for `c1.api.finding.v1.FindingOwnerRef` for more details. - `managerOfUserId` string, nullable — The managerOfUserId field. This field is part of the `owner` oneof. See the documentation for `c1.api.finding.v1.FindingOwnerRef` for more details. - `userSetId` string, nullable — The userSetId field. This field is part of the `owner` oneof. See the documentation for `c1.api.finding.v1.FindingOwnerRef` for more details. - `connectorAnomalyDetectionDisabled` C1ApiFindingV1ConnectorAnomalyDetectionDisabledType — ConnectorAnomalyDetectionDisabledType: a connector has sync anomaly detection turned off, so a sudden drop in synced data will not trip the circuit breaker. Target: ConnectorTarget. - `connectorTarget` C1ApiFindingV1ConnectorTarget — ConnectorTarget points at the connector that produced this finding. - `appId` string — The appId field. - `connectorId` string — The connectorId field. - `createdAt` string, date-time, nullable - `credentialExpiring` C1ApiFindingV1CredentialExpiringType — CredentialExpiringType: a ConductorOne-managed credential is inside the detector's expiry warning window, or already past it. Dedup is (credential arm, credential_id). Target: IdentityUserTarget -- the identity holding the credential. This message contains a oneof named credential. Only a single field of the following list may be set at a time: - userClientId - `credentialDisplayName` string — The credentialDisplayName field. - `userClientId` string, nullable — Service-principal credential. This field is part of the `credential` oneof. See the documentation for `c1.api.finding.v1.CredentialExpiringType` for more details. - `credentialExpiringEvidence` C1ApiFindingV1CredentialExpiringEvidence — The CredentialExpiringEvidence message. - `expired` boolean — Whether the expiry was already past when last observed. - `expiresAt` string, date-time, nullable - `credentialPubliclyExposed` C1ApiFindingV1CredentialPubliclyExposedType — CredentialPubliclyExposedType: a live credential was reported as publicly exposed. Dedup is (credential arm, credential_id). This message contains a oneof named credential. Only a single field of the following list may be set at a time: - userClientId - connectorClientId - connectorManagedCredentialId - functionClientId - `connectorClientId` string, nullable — The connectorClientId field. This field is part of the `credential` oneof. See the documentation for `c1.api.finding.v1.CredentialPubliclyExposedType` for more details. - `connectorManagedCredentialId` string, nullable — The connectorManagedCredentialId field. This field is part of the `credential` oneof. See the documentation for `c1.api.finding.v1.CredentialPubliclyExposedType` for more details. - `credentialDisplayName` string — The credentialDisplayName field. - `functionClientId` string, nullable — The functionClientId field. This field is part of the `credential` oneof. See the documentation for `c1.api.finding.v1.CredentialPubliclyExposedType` for more details. - `userClientId` string, nullable — The userClientId field. This field is part of the `credential` oneof. See the documentation for `c1.api.finding.v1.CredentialPubliclyExposedType` for more details. - `credentialPubliclyExposedEvidence` C1ApiFindingV1CredentialPubliclyExposedEvidence — CredentialPubliclyExposedEvidence carries scanner attribution for a public exposure. - `credentialRevoked` boolean — The credentialRevoked field. - `fingerprintPrefix` string — The fingerprintPrefix field. - `firstObservedAt` string, date-time, nullable - `firstScannerId` string — The firstScannerId field. - `reportingScanners` string[], nullable — The reportingScanners field. - `revokedAt` string, date-time, nullable - `sourceKind` string — The sourceKind field. - `sourceUrl` string — The sourceUrl field. - `custom` C1ApiFindingV1CustomFindingType — CustomFindingType: a user- or integration-authored finding. The discriminator carries no payload; the finding's content lives in description / remediation_description / custom_tags. - `customSubType` string — User-supplied sub-classification for custom findings (e.g. "shadow_it"). - `customTags` object — Deprecated: use annotations instead. Read-only mirror of annotations; writes to this field are ignored. - `deactivatedOwner` C1ApiFindingV1DeactivatedOwnerType — DeactivatedOwnerType: the human responsible for a target -- either the AppUser's own correlated identity, or the ownership_v2-assigned owner of an AppResource/service-account AppUser -- is deactivated. Target: AppUserTarget or AppResourceTarget. - `source` 'DEACTIVATED_OWNER_SOURCE_UNSPECIFIED' | 'DEACTIVATED_OWNER_SOURCE_IDENTITY_CORRELATION' | 'DEACTIVATED_OWNER_SOURCE_OWNERSHIP_ASSIGNED' — The source field. - `deactivatedOwnerEvidence` C1ApiFindingV1DeactivatedOwnerEvidence — The DeactivatedOwnerEvidence message. - `deactivatedOwners` C1ApiFindingV1DeactivatedOwnerDetail[], nullable — The deactivatedOwners field. - `reason` 'DEACTIVATED_OWNER_REASON_UNSPECIFIED' | 'DEACTIVATED_OWNER_REASON_USER_DELETED' | 'DEACTIVATED_OWNER_REASON_USER_DISABLED' | 'DEACTIVATED_OWNER_REASON_EMPLOYMENT_INACTIVE' — The reason field. - `userId` string — The userId field. - `decoyCredentialUsed` C1ApiFindingV1DecoyCredentialUsedType — DecoyCredentialUsedType: a planted decoy credential authenticated successfully. - `decoyId` string — The decoyId field. - `kind` 'DECOY_CREDENTIAL_KIND_UNSPECIFIED' | 'DECOY_CREDENTIAL_KIND_USER_CLIENT_CREDENTIAL' | 'DECOY_CREDENTIAL_KIND_CONNECTOR_CLIENT' | 'DECOY_CREDENTIAL_KIND_WORKLOAD_FEDERATION' | 'DECOY_CREDENTIAL_KIND_ACCESS_TOKEN' — The kind field. - `decoyPubliclyExposed` C1ApiFindingV1DecoyPubliclyExposedType — DecoyPubliclyExposedType: a planted decoy was reported as publicly exposed. Dedup is decoy_id. - `decoyDisplayName` string — The decoyDisplayName field. - `decoyId` string — The decoyId field. - `decoyPubliclyExposedEvidence` C1ApiFindingV1DecoyPubliclyExposedEvidence — DecoyPubliclyExposedEvidence mirrors CredentialPubliclyExposedEvidence for decoys. - `credentialRevoked` boolean — The credentialRevoked field. - `fingerprintPrefix` string — The fingerprintPrefix field. - `firstObservedAt` string, date-time, nullable - `firstScannerId` string — The firstScannerId field. - `reportingScanners` string[], nullable — The reportingScanners field. - `revokedAt` string, date-time, nullable - `sourceKind` string — The sourceKind field. - `sourceUrl` string — The sourceUrl field. - `decoyTarget` C1ApiFindingV1DecoyTarget — DecoyTarget points at the planted decoy that produced this finding. Populated for findings whose subject is the decoy artifact itself (e.g. decoy_credential_used), giving the UI and routing rules a uniform handle to the decoy alongside the finding_type payload. - `decoyId` string — The decoyId field. - `dedupKeyParts` string[], nullable — Caller-supplied dedup identity for custom findings; echoed back so IaC clients can roundtrip it. Empty for detector findings. - `description` string — User-authored finding body (markdown by convention). Set for custom findings. - `fingerprint` string — The fingerprint field. - `firstObservedAt` string, date-time, nullable - `id` string — The id field. - `identityUserTarget` C1ApiFindingV1IdentityUserTarget — The IdentityUserTarget message. - `identityUserId` string — The identityUserId field. - `lastAppearedAt` string, date-time, nullable - `lastObservedAt` string, date-time, nullable - `nhiUnowned` C1ApiFindingV1NhiUnownedType — NhiUnownedType: an AppResource with a non-human-identity type has no primary owner. Target: AppResourceTarget (the unowned NHI resource). - `recurrenceCount` integer — The recurrenceCount field. - `remediationDescription` string — The remediationDescription field. - `resolvedAt` string, date-time, nullable - `riskAcceptanceExpiresAt` string, date-time, nullable - `riskAcceptanceJustification` string — The riskAcceptanceJustification field. - `riskScore` C1ApiFindingV1FindingRiskScore — The FindingRiskScore message. - `originalScore` integer — The originalScore field. - `overrideByUserId` string — The overrideByUserId field. - `overrideScore` integer — The overrideScore field. - `riskFactors` C1ApiFindingV1FindingRiskFactor[], nullable — The riskFactors field. - `description` string — The description field. - `name` string — The name field. - `severity` 'FINDING_SEVERITY_UNSPECIFIED' | 'FINDING_SEVERITY_INFO' | 'FINDING_SEVERITY_LOW' | 'FINDING_SEVERITY_MEDIUM' | 'FINDING_SEVERITY_HIGH' | 'FINDING_SEVERITY_CRITICAL' — The severity field. - `weight` integer — The weight field. - `score` integer — The score field. - `systemScore` integer — The systemScore field. - `serviceAccountMisclassification` C1ApiFindingV1ServiceAccountMisclassificationType — The ServiceAccountMisclassificationType message. - `currentAccountType` 'APP_USER_TYPE_UNSPECIFIED' | 'APP_USER_TYPE_USER' | 'APP_USER_TYPE_SERVICE_ACCOUNT' | 'APP_USER_TYPE_SYSTEM_ACCOUNT' — The currentAccountType field. - `detectedAccountType` 'APP_USER_TYPE_UNSPECIFIED' | 'APP_USER_TYPE_USER' | 'APP_USER_TYPE_SERVICE_ACCOUNT' | 'APP_USER_TYPE_SYSTEM_ACCOUNT' — The detectedAccountType field. - `serviceAccountMisclassificationEvidence` C1ApiFindingV1ServiceAccountMisclassificationEvidence — The ServiceAccountMisclassificationEvidence message. - `detectionReason` string — The detectionReason field. - `serviceAccountUnowned` C1ApiFindingV1ServiceAccountUnownedType — ServiceAccountUnownedType: a service-account-classified AppUser has no primary owner. Target: AppUserTarget (the unowned service account). - `severity` 'FINDING_SEVERITY_UNSPECIFIED' | 'FINDING_SEVERITY_INFO' | 'FINDING_SEVERITY_LOW' | 'FINDING_SEVERITY_MEDIUM' | 'FINDING_SEVERITY_HIGH' | 'FINDING_SEVERITY_CRITICAL' — The severity field. - `similarUsernameMatch` C1ApiFindingV1SimilarUsernameMatchType — The SimilarUsernameMatchType message. - `proposedIdentityUserId` string — The proposedIdentityUserId field. - `similarUsernameMatchEvidence` C1ApiFindingV1SimilarUsernameMatchEvidence — The SimilarUsernameMatchEvidence message. - `appUsername` string — The appUsername field. - `identityUsername` string — The identityUsername field. - `similarityScore` number — The similarityScore field. - `snoozeReason` string — The snoozeReason field. - `snoozeUntil` string, date-time, nullable - `sourceDetectorId` string — The sourceDetectorId field. - `sourceKind` 'FINDING_SOURCE_KIND_UNSPECIFIED' | 'FINDING_SOURCE_KIND_DETECTOR' | 'FINDING_SOURCE_KIND_EXTERNAL' — Who authored the finding (detector, user, external). - `state` 'FINDING_STATE_UNSPECIFIED' | 'FINDING_STATE_OPEN' | 'FINDING_STATE_IN_PROGRESS' | 'FINDING_STATE_RESOLVED' | 'FINDING_STATE_SNOOZED' | 'FINDING_STATE_RISK_ACCEPTED' | 'FINDING_STATE_SUPPRESSED' — The state field. - `stateUpdatedById` string — The stateUpdatedById field. - `suppressReason` string — The suppressReason field. - `taskId` string — The taskId field. - `tenantTarget` C1ApiFindingV1TenantTarget — TenantTarget scopes a finding to the whole tenant. It carries no subject id; the finding's tenant is the scope. - `unusedSecret` C1ApiFindingV1UnusedSecretType — UnusedSecretType: a secret-trait AppResource has not been used in over the detector's staleness threshold. Target: AppResourceTarget. - `unusedSecretEvidence` C1ApiFindingV1UnusedSecretEvidence — The UnusedSecretEvidence message. - `lastUsedAt` string, date-time, nullable - `updatedAt` string, date-time, nullable - `nextPageToken` string — The nextPageToken field. --- [API](https://skmtc.net/conductorone/apis/c1-api.md) · [All operations](https://skmtc.net/conductorone/apis/c1-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/conductorone/c1-api/revisions/f2cf3228f366/schema)