--- title: "Search Grants" method: POST path: "/api/v1/search/grants" tags: ["App Entitlement"] --- # Search Grants `POST /api/v1/search/grants` Search grants (user-to-entitlement bindings) across apps, with filters for app, user, resource type, and entitlement. Rows are heavy (each binding carries a full entitlement + user view) — request a small page_size (≤10) and set expand_mask to only the paths you need; broad expansion inlines whole related objects and bloats the response. ## Request body - C1ApiAppV1AppEntitlementSearchServiceSearchGrantsRequest — The AppEntitlementSearchServiceSearchGrantsRequest message. - `appIds` string[], nullable — Search for grants contained in any of these apps. - `appUserIds` string[], nullable — Search for grants that are granted to any of these app user ids. - `entitlementRefs` C1ApiAppV1AppEntitlementRef[], nullable — Search for grants of an entitlement - `appId` string — The appId field. - `id` string — The id field. - `entitlementSlugs` string[], nullable — Filter for entitlements whose slug is in this list (e.g. "enrollment" for access profiles) - `expandMask` C1ApiAppV1AppEntitlementExpandMask — The app entitlement expand mask allows the user to get additional information when getting responses containing app entitlement views. - `paths` string[], nullable — Array of strings to describe which items to expand on the return value. Can be any combination of "*", "app_id", "app_resource_type_id", or "app_resource_id". - `pageSize` integer — The pageSize where 0 <= pageSize <= 100. Values < 10 will be set to 10. A value of 0 returns the default page size (currently 25) - `pageToken` string — The pageToken field. - `purpose` string[], nullable — Filter for entitlements with these purposes (e.g., ASSIGNMENT for membership entitlements) - `resourceIds` string[], nullable — Search for grants within a resource. - `resourceTypeIds` string[], nullable — Search grants for given resource types. - `userId` string — Search for grants of a user ## Response `200` Successful response - C1ApiAppV1AppEntitlementSearchServiceSearchGrantsResponse — The AppEntitlementSearchServiceSearchGrantsResponse message. - `expanded` object[], nullable — The expanded field. - `@type` string — The type of the serialized message. - `list` C1ApiAppV1AppEntitlementWithUserBinding[], nullable — The list field. - `appEntitlementUserBinding` C1ApiAppV1AppEntitlementUserView — The AppEntitlementUserView (aka grant view) describes the relationship between an app user and an entitlement. They have more recently been referred to as grants. - `appEntitlementId` string — The ID of the app entitlement that the app user has access to. - `appEntitlementUserBindingCreatedAt` string, date-time, nullable - `appEntitlementUserBindingDeprovisionAt` string, date-time, nullable - `appId` string — The ID of the app associated with the grant. - `appUser` C1ApiAppV1AppUserView — The AppUserView contains an app user as well as paths for apps, identity users, and last usage in expanded arrays. - `appPath` string — JSONPATH expression indicating where the app is expanded in expanded arrays indicated in the request. - `appUser` C1ApiAppV1AppUser — Application User that represents an account in the application. - `agentStatus` 'APP_USER_AGENT_STATUS_UNSPECIFIED' | 'APP_USER_AGENT_STATUS_READY' | 'APP_USER_AGENT_STATUS_DISABLED' | 'APP_USER_AGENT_STATUS_DELETED' — AI-agent lifecycle status when this app user carries the agent trait. UNSPECIFIED marks a non-agent account. Read-only; translated from the model's agent_trait at the API boundary. - `appId` string — The ID of the application. - `appUserType` 'APP_USER_TYPE_UNSPECIFIED' | 'APP_USER_TYPE_USER' | 'APP_USER_TYPE_SERVICE_ACCOUNT' | 'APP_USER_TYPE_SYSTEM_ACCOUNT' — The appplication user type. Type can be user, system or service. - `createdAt` string, date-time, nullable - `deletedAt` string, date-time, nullable - `displayName` string — The display name of the application user. - `email` string — The email field of the application user. - `emails` string[], nullable — The emails field of the application user. - `employeeIds` string[], nullable — The employee IDs field of the application user. - `id` string — A unique idenditfier of the application user. - `identityUserId` string — The conductor one user ID of the account owner. - `isExternal` boolean — The isExternal field. - `nhiDetail` string — Axis-2 detail refining nhi_type (e.g. "aws.role.lambda"). Read-only. - `nhiType` 'APP_USER_NHI_TYPE_UNSPECIFIED' | 'APP_USER_NHI_TYPE_APP_REGISTRATION' | 'APP_USER_NHI_TYPE_ASSUMABLE_ROLE' | 'APP_USER_NHI_TYPE_MANAGED_IDENTITY' — NHI classification when this app user carries the non-human-identity trait. Read-only; translated from the model's nhi_trait at the API boundary. - `profile` object, nullable - `status` C1ApiAppV1AppUserStatus — The satus of the applicaiton user. - `details` string — The details of applicaiton user status. - `status` 'STATUS_UNSPECIFIED' | 'STATUS_ENABLED' | 'STATUS_DISABLED' | 'STATUS_DELETED' — The application user status field. - `updatedAt` string, date-time, nullable - `username` string — The username field of the application user. - `usernames` string[], nullable — The usernames field of the application user. - `identityUserPath` string — JSONPATH expression indicating where the identity user is expanded in expanded arrays indicated in the request. - `lastUsagePath` string — JSONPATH expression indicating where the last usage information is expanded in expanded arrays indicated in the request. - `appUserId` string — The ID of the app user that has access to the app entitlement. - `grantSources` C1ApiAppV1AppEntitlementRef[], nullable — List of sources for the grant, ie. groups, roles, etc. - `appId` string — The appId field. - `id` string — The id field. - `originatingTicketId` string — The originating ticket ID for the grant (e.g. from a request ticket). - `entitlement` C1ApiAppV1AppEntitlementView — The app entitlement view contains the serialized app entitlement and paths to objects referenced by the app entitlement. - `appEntitlement` C1ApiAppV1AppEntitlement — The app entitlement represents one permission in a downstream App (SAAS) that can be granted. For example, GitHub Read vs GitHub Write. This message contains a oneof named max_grant_duration. Only a single field of the following list may be set at a time: - durationUnset - durationGrant - `alias` string — The alias of the app entitlement used by Cone. Also exact-match queryable. - `annotations` object — Bounded key/value metadata bag for IaC marking and customer tags. See .rfcs/object-annotations.md §2. Limits: ≤16 entries; keys 1–128 chars matching ^[A-Za-z][A-Za-z0-9._/-]{0,127}$; values 0–256 chars URL-safe ASCII; total serialized ≤ 4096 bytes. Keys matching ^c1/ are reserved. Well-known keys: `managed_by`, `iac_workspace`, `iac_resource_address`, `iac_tool_version`. - `appId` string — The ID of the app that is associated with the app entitlement. - `appResourceId` string — The ID of the app resource that is associated with the app entitlement - `appResourceTypeId` string — The ID of the app resource type that is associated with the app entitlement - `certifyPolicyId` string — The ID of the policy that will be used for certify tickets related to the app entitlement. - `complianceFrameworkValueIds` string[], nullable — The IDs of different compliance frameworks associated with this app entitlement ex (SOX, HIPAA, PCI, etc.) - `createdAt` string, date-time, nullable - `defaultValuesApplied` boolean — Flag to indicate if app-level access request defaults have been applied to the entitlement - `deletedAt` string, date-time, nullable - `deprovisionerPolicy` C1ApiPolicyV1ProvisionPolicy — ProvisionPolicy is a oneOf that indicates how a provision step should be processed. This message contains a oneof named typ. Only a single field of the following list may be set at a time: - connector - manual - delegated - webhook - multiStep - externalTicket - unconfigured - action - devicePlacement - `action` C1ApiPolicyV1ActionProvision — This provision step indicates that account lifecycle action should be called to provision this entitlement. - `actionName` string — The actionName field. - `appId` string — The appId field. - `connectorId` string — The connectorId field. - `displayName` string — The displayName field. - `connector` C1ApiPolicyV1ConnectorProvision — Indicates that a connector should perform the provisioning. This object has no fields. This message contains a oneof named provision_type. Only a single field of the following list may be set at a time: - defaultBehavior - account - deleteAccount - `account` C1ApiPolicyV1ConnectorProvisionAccountProvision — The AccountProvision message. This message contains a oneof named storage_type. Only a single field of the following list may be set at a time: - saveToVault - doNotSave - … - `defaultBehavior` C1ApiPolicyV1ConnectorProvisionDefaultBehavior — The DefaultBehavior message. - … - `deleteAccount` C1ApiPolicyV1ConnectorProvisionDeleteAccount — The DeleteAccount message. - … - `delegated` C1ApiPolicyV1DelegatedProvision — This provision step indicates that we should delegate provisioning to the configuration of another app entitlement. This app entitlement does not have to be one from the same app, but MUST be configured as a proxy binding leading into this entitlement. - `appId` string — The AppID of the entitlement to delegate provisioning to. - `entitlementId` string — The ID of the entitlement we are delegating provisioning to. - `implicit` boolean — If true, a binding will be automatically created from the entitlement of the parent app. - `devicePlacement` C1ApiPolicyV1DevicePlacementProvision — This provision step is fulfilled by a Latchkey member device producing an MLS Welcome for the recipient. It has no assignee and no instructions because the step is not human-actionable. - `vaultBoundaryId` string — The vaultBoundaryId field. - `externalTicket` C1ApiPolicyV1ExternalTicketProvision — This provision step indicates that we should check an external ticket to provision this entitlement - `appId` string — The appId field. - `connectorId` string — The connectorId field. - `externalTicketProvisionerConfigId` string — The externalTicketProvisionerConfigId field. - `instructions` string — This field indicates a text body of instructions for the provisioner to indicate. - `manual` C1ApiPolicyV1ManualProvision — Manual provisioning indicates that a human must intervene for the provisioning of this step. - `assignee` C1ApiPolicyV1ProvisionerAssignment — ProvisionerAssignment defines how a provisioner is dynamically assigned. This message contains a oneof named typ. Only a single field of the following list may be set at a time: - users - appOwners - group - manager - expression - entitlementOwners - … - `instructions` string — This field indicates a text body of instructions for the provisioner to indicate. - `userIds` string[], nullable — An array of users that are required to provision during this step. Deprecated: Use assignee field instead for dynamic provisioner assignment. - `multiStep` C1ApiPolicyV1MultiStep — MultiStep indicates that this provision step has multiple steps to process. - `provisionSteps` C1ApiPolicyV1ProvisionPolicy[], nullable — The array of provision steps to process. - `unconfigured` C1ApiPolicyV1UnconfiguredProvision — The UnconfiguredProvision message. - `webhook` C1ApiPolicyV1WebhookProvision — This provision step indicates that a webhook should be called to provision this entitlement. - `webhookId` string — The ID of the webhook to call for provisioning. - `description` string — The description of the app entitlement. - `displayName` string — The display name of the app entitlement. - `durationGrant` string, duration, nullable - `durationUnset` object, nullable - `emergencyGrantEnabled` boolean — This enables tasks to be created in an emergency and use a selected emergency access policy. - `emergencyGrantPolicyId` string — The ID of the policy that will be used for emergency access grant tasks. - `externalId` string — The upstream product's native external ID for this entitlement (e.g. an Okta group ID). Populated from the connector's external ID during sync. - `grantCount` string, int64 — The amount of grants open for this entitlement - `grantPolicyId` string — The ID of the policy that will be used for grant tickets related to the app entitlement. - `id` string — The unique ID for the App Entitlement. - `isAutomationEnabled` boolean — Flag to indicate whether automation (for adding users to entitlement based on rules) has been enabled. - `isManuallyManaged` boolean — Flag to indicate if the app entitlement is manually managed. - `matchBatonId` string — An identifier used to match this entitlement to a connector-synced entitlement during sync. - `overrideAccessRequestsDefaults` boolean — Flag to indicate if the app-level access request settings have been overridden for the entitlement - `provisionerPolicy` C1ApiPolicyV1ProvisionPolicy — ProvisionPolicy is a oneOf that indicates how a provision step should be processed. This message contains a oneof named typ. Only a single field of the following list may be set at a time: - connector - manual - delegated - webhook - multiStep - externalTicket - unconfigured - action - devicePlacement - `action` C1ApiPolicyV1ActionProvision — This provision step indicates that account lifecycle action should be called to provision this entitlement. - `actionName` string — The actionName field. - `appId` string — The appId field. - `connectorId` string — The connectorId field. - `displayName` string — The displayName field. - `connector` C1ApiPolicyV1ConnectorProvision — Indicates that a connector should perform the provisioning. This object has no fields. This message contains a oneof named provision_type. Only a single field of the following list may be set at a time: - defaultBehavior - account - deleteAccount - `account` C1ApiPolicyV1ConnectorProvisionAccountProvision — The AccountProvision message. This message contains a oneof named storage_type. Only a single field of the following list may be set at a time: - saveToVault - doNotSave - … - `defaultBehavior` C1ApiPolicyV1ConnectorProvisionDefaultBehavior — The DefaultBehavior message. - … - `deleteAccount` C1ApiPolicyV1ConnectorProvisionDeleteAccount — The DeleteAccount message. - … - `delegated` C1ApiPolicyV1DelegatedProvision — This provision step indicates that we should delegate provisioning to the configuration of another app entitlement. This app entitlement does not have to be one from the same app, but MUST be configured as a proxy binding leading into this entitlement. - `appId` string — The AppID of the entitlement to delegate provisioning to. - `entitlementId` string — The ID of the entitlement we are delegating provisioning to. - `implicit` boolean — If true, a binding will be automatically created from the entitlement of the parent app. - `devicePlacement` C1ApiPolicyV1DevicePlacementProvision — This provision step is fulfilled by a Latchkey member device producing an MLS Welcome for the recipient. It has no assignee and no instructions because the step is not human-actionable. - `vaultBoundaryId` string — The vaultBoundaryId field. - `externalTicket` C1ApiPolicyV1ExternalTicketProvision — This provision step indicates that we should check an external ticket to provision this entitlement - `appId` string — The appId field. - `connectorId` string — The connectorId field. - `externalTicketProvisionerConfigId` string — The externalTicketProvisionerConfigId field. - `instructions` string — This field indicates a text body of instructions for the provisioner to indicate. - `manual` C1ApiPolicyV1ManualProvision — Manual provisioning indicates that a human must intervene for the provisioning of this step. - `assignee` C1ApiPolicyV1ProvisionerAssignment — ProvisionerAssignment defines how a provisioner is dynamically assigned. This message contains a oneof named typ. Only a single field of the following list may be set at a time: - users - appOwners - group - manager - expression - entitlementOwners - … - `instructions` string — This field indicates a text body of instructions for the provisioner to indicate. - `userIds` string[], nullable — An array of users that are required to provision during this step. Deprecated: Use assignee field instead for dynamic provisioner assignment. - `multiStep` C1ApiPolicyV1MultiStep — MultiStep indicates that this provision step has multiple steps to process. - `provisionSteps` C1ApiPolicyV1ProvisionPolicy[], nullable — The array of provision steps to process. - `unconfigured` C1ApiPolicyV1UnconfiguredProvision — The UnconfiguredProvision message. - `webhook` C1ApiPolicyV1WebhookProvision — This provision step indicates that a webhook should be called to provision this entitlement. - `webhookId` string — The ID of the webhook to call for provisioning. - `purpose` 'APP_ENTITLEMENT_PURPOSE_VALUE_UNSPECIFIED' | 'APP_ENTITLEMENT_PURPOSE_VALUE_ASSIGNMENT' | 'APP_ENTITLEMENT_PURPOSE_VALUE_PERMISSION' | 'APP_ENTITLEMENT_PURPOSE_VALUE_OWNERSHIP' — The purpose of this entitlement (e.g., assignment, permission, ownership). - `requestSchemaId` string — The ID of the request schema associated with this app entitlement. - `revokePolicyId` string — The ID of the policy that will be used for revoke tickets related to the app entitlement - `riskLevelValueId` string — The ID of the risk level assigned to this entitlement. - `slug` string — The slug is displayed as an oval next to the name in the frontend of C1, it tells you what permission the entitlement grants. See https://www.conductorone.com/docs/product/admin/entitlements/ - `sourceConnectorIds` object — Map to tell us which connector the entitlement came from. - `systemBuiltin` boolean — This field indicates if this is a system builtin entitlement. - `updatedAt` string, date-time, nullable - `userEditedMask` string, nullable - `appPath` string — JSONPATH expression indicating the location of the App object in the array. - `appResourcePath` string — JSONPATH expression indicating the location of the App Resource Type object in the expanded array. - `appResourceTypePath` string — JSONPATH expression indicating the location of the App Resource object in the array. - `objectPermissions` C1ApiIamV1ActorObjectPermissions — Legacy: do not use for new objects. Retained only for the existing AppResource / AppEntitlement / access-review consumers, which will migrate to c1.api.authorization.v1.ActorObjectPermissions in IGA-2331. New object views should reference c1.api.authorization.v1.ActorObjectPermissions instead. - `delete` boolean — The delete field. - `edit` boolean — The edit field. - `extra` object — The extra field. - `read` boolean — The read field. - `nextPageToken` string — The nextPageToken field. --- [API](https://skmtc.net/conductorone/apis/c1-api.md) · [All operations](https://skmtc.net/conductorone/apis/c1-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/conductorone/c1-api/revisions/f2cf3228f366/schema)