---
title: "Search"
method: POST
path: "/api/v1/search/finding_audits"
tags: ["Findings"]
---

# Search

`POST /api/v1/search/finding_audits`

Search returns audit events filtered by finding, actor, type, or
 app. Authorized as VIEWER -- the same role required to read the
 finding itself.

## Request body

- C1ApiFindingV1FindingAuditServiceSearchRequest — The FindingAuditServiceSearchRequest message.
  - `actorPrincipalId` string — The actorPrincipalId field.
  - `actorSubject` string — Partial match via full-text search over the denormalized actor email / display name column.
  - `appId` string — Empty skips the filter; non-empty must be a 27-char alphanumeric id.
  - `eventTypes` string[], nullable — Filter by one or more event types. Empty means any.
  - `findingId` string — Filter to a single finding. The detail-page timeline uses this. Empty skips the filter; non-empty must be a 27-char alphanumeric id.
  - `pageSize` integer — The pageSize field.
  - `pageToken` string — The pageToken field.
  - `since` string, date-time, nullable
  - `until` string, date-time, nullable

## Response `200`

Successful response

- C1ApiFindingV1FindingAuditServiceSearchResponse — The FindingAuditServiceSearchResponse message.
  - `list` C1ApiFindingV1FindingAuditEvent[], nullable — The list field.
    - `actorPrincipalId` string — Principal id of the actor that performed the action. Empty for system-driven events (snooze expiry, risk-acceptance expiry).
    - `actorSubject` string — Display string for the actor (email for human users, "system" for cron sweeps).
    - `appId` string — The appId field.
    - `bulkOperationId` string — Stable id grouping events from the same bulk operation.
    - `createdAt` string, date-time, nullable
    - `eventId` string — The eventId field.
    - `eventType` 'FINDING_AUDIT_EVENT_TYPE_UNSPECIFIED' | 'FINDING_AUDIT_EVENT_TYPE_CREATED' | 'FINDING_AUDIT_EVENT_TYPE_STATE_CHANGED' | 'FINDING_AUDIT_EVENT_TYPE_SNOOZED' | 'FINDING_AUDIT_EVENT_TYPE_SNOOZE_EXPIRED' | 'FINDING_AUDIT_EVENT_TYPE_RISK_ACCEPTED' | 'FINDING_AUDIT_EVENT_TYPE_RISK_ACCEPTANCE_EXPIRED' | 'FINDING_AUDIT_EVENT_TYPE_SUPPRESSED' | 'FINDING_AUDIT_EVENT_TYPE_UNSUPPRESSED' | 'FINDING_AUDIT_EVENT_TYPE_RESOLVED' | 'FINDING_AUDIT_EVENT_TYPE_REOPENED' | 'FINDING_AUDIT_EVENT_TYPE_OWNER_CHANGED' | 'FINDING_AUDIT_EVENT_TYPE_SEVERITY_OVERRIDDEN' | 'FINDING_AUDIT_EVENT_TYPE_COMMENT' | 'FINDING_AUDIT_EVENT_TYPE_TASK_CREATED' | 'FINDING_AUDIT_EVENT_TYPE_TASK_CANCELLED' | 'FINDING_AUDIT_EVENT_TYPE_EVIDENCE_UPDATED' | 'FINDING_AUDIT_EVENT_TYPE_ROUTING_EVALUATED' | 'FINDING_AUDIT_EVENT_TYPE_TRANSFORMED' — The eventType field.
    - `findingId` string — The findingId field.
    - `ocsf` object, nullable
    - `severityAtEvent` 'FINDING_SEVERITY_UNSPECIFIED' | 'FINDING_SEVERITY_INFO' | 'FINDING_SEVERITY_LOW' | 'FINDING_SEVERITY_MEDIUM' | 'FINDING_SEVERITY_HIGH' | 'FINDING_SEVERITY_CRITICAL' — The severityAtEvent field.
    - `stateAtEvent` 'FINDING_STATE_UNSPECIFIED' | 'FINDING_STATE_OPEN' | 'FINDING_STATE_IN_PROGRESS' | 'FINDING_STATE_RESOLVED' | 'FINDING_STATE_SNOOZED' | 'FINDING_STATE_RISK_ACCEPTED' | 'FINDING_STATE_SUPPRESSED' — The stateAtEvent field.
    - `ticketId` string — Ticket id when the event involved one; empty otherwise.
  - `nextPageToken` string — The nextPageToken field.

---

[API](https://skmtc.net/conductorone/apis/c1-api.md) · [All operations](https://skmtc.net/conductorone/apis/c1-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/conductorone/c1-api/revisions/f2cf3228f366/schema)