---
title: "Search App Resources"
method: POST
path: "/api/v1/search/app_resources"
tags: ["App Resource"]
---

# Search App Resources

`POST /api/v1/search/app_resources`

Search app resources based on filters specified in the request body.

## Request body

- C1ApiAppV1SearchAppResourcesRequest — Search app resources based on filters specified in the request body.
  - `agentStatuses` string[], nullable — Restrict the search to AI-agent resources with one of the given agent lifecycle statuses (READY, DISABLED, DELETED). When empty, agent status is not used as a filter.
  - `appId` string — The app ID to restrict the search to.
  - `appIds` string[], nullable — A list of app IDs to restrict the search to. Mirrors the singular app_id; both fold into the same filter, so callers may set either or both.
  - `appUserIds` string[], nullable — A list of app user IDs to restrict the search by.
  - `credentialTypes` string[], nullable — Restrict the search to resources whose credential material spine (K1) matches one of the given CredentialType values. Applies to resources with a secret_trait. When empty, credential_type is not used as a filter.
  - `direction` 'SORT_DIRECTION_UNSPECIFIED' | 'SORT_DIRECTION_ASC' | 'SORT_DIRECTION_DESC' — Direction to sort in. Unspecified falls back to ASC when sort_field is set. No defined_only validation here: protoc-gen-validate mis-resolves the cross-package enum name map to this file's c1.models.app.v1 import alias instead of c1.api.search.v1, which fails to compile. The query builder already treats any unrecognized value as ASC, so this is safe to omit.
  - `excludeDeletedApps` boolean — When true, excludes resources belonging to soft-deleted apps.
  - `excludeDeletedResourceBindings` boolean — If true, exclude resources whose bindings have been deleted.
  - `excludeResourceIds` string[], nullable — A list of resource IDs to exclude from the search results.
  - `excludeResourceTypeTraitIds` string[], nullable — A list of resource type trait IDs to exclude from the search.
  - `nhiTypes` string[], nullable — Restrict the search to resources whose NHI classification spine (K3) is one of the given NhiType values. When empty, nhi_type is not used as a filter.
  - `ownerUserIds` string[], nullable — A list of C1 user IDs to filter resources by ownership. The sentinel value "none" matches resources with no owner. Mutually exclusive with unowned_only — combine "none" with real owner IDs instead of setting unowned_only alongside them.
  - `pageSize` integer — The maximum number of results to return per page.
  - `pageToken` string — The token for fetching the next page of results.
  - `query` string — Fuzzy search the display name of resources.
  - `refs` C1ApiAppV1AppResourceRef[], nullable — A list of specific app resource references to restrict the search to.
    - `appId` string — The ID of the app that owns the resource.
    - `appResourceTypeId` string — The ID of the resource type that classifies this resource.
    - `id` string — The unique ID of the app resource.
  - `resourceIds` string[], nullable — A list of resource IDs to restrict the search to.
  - `resourceTypeIds` string[], nullable — A list of resource type IDs to restrict the search by.
  - `resourceTypeTraitIds` string[], nullable — A list of resource type trait IDs to restrict the search by.
  - `secretAging` C1ApiAppV1SecretAgingFilter — SecretAgingFilter restricts a resource search to secrets (credential_type != 0) whose secret-trait timestamps fall in the given half-open ranges. Each bound is optional; leave one unset for an open-ended range. All set bounds are ANDed. Callers pass absolute timestamps (computed against their reference "now").
    - `lastUsedAfter` string, date-time, nullable
    - `lastUsedBefore` string, date-time, nullable
    - `secretCreatedAfter` string, date-time, nullable
    - `secretCreatedBefore` string, date-time, nullable
    - `secretExpiresAfter` string, date-time, nullable
    - `secretExpiresBefore` string, date-time, nullable
  - `sortField` 'APP_RESOURCE_SORT_FIELD_UNSPECIFIED' | 'APP_RESOURCE_SORT_FIELD_SECRET_CREATED_AT' | 'APP_RESOURCE_SORT_FIELD_SECRET_EXPIRES_AT' | 'APP_RESOURCE_SORT_FIELD_LAST_USED_AT' — Column to sort by. Unspecified (0) keeps the server's default order (app, then display name).
  - `unownedOnly` boolean — When true, restrict results to resources with no ownership-v2 primary-role owner. Mutually exclusive with owner_user_ids — use owner_user_ids: ["none"] instead if you also need to combine it with real owner IDs.
  - `withOpenFindings` boolean — When true, restrict results to resources that have at least one open finding (index-backed EXISTS semi-join). When false/unset, results are unfiltered.

## Response `200`

The SearchAppResourcesResponse message contains a list of results and a nextPageToken if applicable.

- C1ApiAppV1SearchAppResourcesResponse — The SearchAppResourcesResponse message contains a list of results and a nextPageToken if applicable.
  - `expanded` object[], nullable — List of serialized related objects.
    - `@type` string — The type of the serialized message.
  - `list` C1ApiAppV1AppResourceView[], nullable — The list of app resource results.
    - `appPath` string — JSONPATH expression indicating the location of the App object in the array
    - `appResource` C1ApiAppV1AppResource — The app resource message is a single resource that can have entitlements. This message contains a oneof named metadata. Only a single field of the following list may be set at a time: - secretTrait
      - `accessConfigId` string — The access config ID for this resource. May be empty. Must be one of the builtin access config IDs or empty.
      - `agentTrait` C1ApiAppV1AgentTrait — AgentTrait carries metadata for AI-agent resources surfaced in the Inventory.
        - `identityAppUserId` string — The C1 app user ID of the service-account identity this agent authenticates as. Empty if the backing identity has not yet been resolved.
        - `status` 'AGENT_STATUS_UNSPECIFIED' | 'AGENT_STATUS_READY' | 'AGENT_STATUS_DISABLED' | 'AGENT_STATUS_DELETED' — The agent's lifecycle status (READY, DISABLED, DELETED).
      - `annotations` object — Bounded key/value metadata bag for IaC marking and customer tags. See .rfcs/object-annotations.md §2. Limits: ≤16 entries; keys 1–128 chars matching ^[A-Za-z][A-Za-z0-9._/-]{0,127}$; values 0–256 chars URL-safe ASCII; total serialized ≤ 4096 bytes. Keys matching ^c1/ are reserved. Well-known keys: `managed_by`, `iac_workspace`, `iac_resource_address`, `iac_tool_version`. Most AppResources are connector-synced; user-supplied annotations on a synced resource will be overwritten by the next sync. The annotations bag is most useful on user-created groups (the `conductorone_app_resource` TF resource).
      - `appId` string — The app that this resource belongs to.
      - `appResourceTypeId` string — The resource type that this resource is.
      - `createdAt` string, date-time, nullable
      - `customDescription` string — A custom description that can be set for a resource.
      - `deletedAt` string, date-time, nullable
      - `description` string — The description set for the resource.
      - `displayName` string — The display name for this resource.
      - `externalId` string — The upstream product's native external ID for this resource (e.g. an Okta group ID). Populated from the connector's external ID during sync.
      - `grantCount` string, int64 — The number of grants to this resource.
      - `id` string — The id of the resource.
      - `matchBatonId` string — The matchBatonId field.
      - `nhiDetail` string — Axis-2 detail refining nhi_type (e.g. "aws.role.lambda"). Read-only; translated from the model.
      - `nhiType` 'NHI_TYPE_UNSPECIFIED' | 'NHI_TYPE_APP_REGISTRATION' | 'NHI_TYPE_ASSUMABLE_ROLE' | 'NHI_TYPE_MANAGED_IDENTITY' — The NHI classification (K3 spine) for this resource. Populated for non-human-identity resources; UNSPECIFIED for everything else. Mirrors agent_trait: read-only and translated from the model enum at the API boundary.
      - `parentAppResourceId` string — The parent resource id, if this resource is a child of another resource.
      - `parentAppResourceTypeId` string — The parent resource type id, if this resource is a child of another resource.
      - `profile` object, nullable
      - `secretTrait` C1ApiAppV1SecretTrait — The SecretTrait message.
        - `createdByAppUserId` string — The AppUser id that created this credential. Read-only; resolved from the model during uplift. Distinct from identity_app_user_id (the holder) and from the resource's Owner (a separate assignment, not part of this message).
        - `credentialDetail` string — Platform-specific credential subtype detail, finer than credential_type (e.g. "GCP service-account key"). Read-only; translated from the model.
        - `identityAppUserId` string — The identityAppUserId field.
        - `lastUsedAt` string, date-time, nullable
        - `secretCreatedAt` string, date-time, nullable
        - `secretExpiresAt` string, date-time, nullable
      - `updatedAt` string, date-time, nullable
    - `objectPermissions` C1ApiIamV1ActorObjectPermissions — Legacy: do not use for new objects. Retained only for the existing AppResource / AppEntitlement / access-review consumers, which will migrate to c1.api.authorization.v1.ActorObjectPermissions in IGA-2331. New object views should reference c1.api.authorization.v1.ActorObjectPermissions instead.
      - `delete` boolean — The delete field.
      - `edit` boolean — The edit field.
      - `extra` object — The extra field.
      - `read` boolean — The read field.
    - `parentResourcePath` string — JSONPATH expression indicating the location of the Parent Resource object in the array
    - `parentResourceTypePath` string — JSONPATH expression indicating the location of the Parent Resource Type object in the array
    - `resourceTypePath` string — JSONPATH expression indicating the location of the Resource Type object in the array
  - `nextPageToken` string — The token for fetching the next page of results.

---

[API](https://skmtc.net/conductorone/apis/c1-api.md) · [All operations](https://skmtc.net/conductorone/apis/c1-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/conductorone/c1-api/revisions/f2cf3228f366/schema)