---
title: "NOTE: Searches external client grants for all users"
method: POST
path: "/api/v1/search/iam/external_clients"
tags: ["External Client"]
---

# NOTE: Searches external client grants for all users

`POST /api/v1/search/iam/external_clients`

Search returns external client grants for all users in the tenant.
 Request a modest page_size (≤25) to keep responses small.

## Request body

- C1ApiIamV1ExternalClientSearchServiceSearchRequest — The ExternalClientSearchServiceSearchRequest message.
  - `clientIdUrls` string[], nullable — Exact-match filter on client_id values (e.g., CIMD URLs). Returns only grants whose client_id matches one of these values.
  - `pageSize` integer — The pageSize field.
  - `pageToken` string — The pageToken field.
  - `query` string — Free-text search on client_name and user display name
  - `users` C1ApiUserV1UserRef[], nullable — Filter by specific user IDs
    - `id` string — The id of the user.
  - `wellKnownClients` string[], nullable — Filter by well-known client type (e.g., CLAUDE_CODE, CURSOR, etc.)

## Response `200`

Successful response

- C1ApiIamV1ExternalClientSearchServiceSearchResponse — The ExternalClientSearchServiceSearchResponse message.
  - `list` C1ApiIamV1ExternalClientInfo[], nullable — Uses ExternalClientInfo with user_id populated for admin views
    - `clientId` string — OAuth2 client ID - canonical identifier for this connection (globally unique per DCR)
    - `clientIdType` 'CLIENT_ID_TYPE_UNSPECIFIED' | 'CLIENT_ID_TYPE_DCR' | 'CLIENT_ID_TYPE_METADATA_URL' | 'CLIENT_ID_TYPE_APP' — How the client_id was established.
    - `clientIdUrl` string — Original CIMD metadata URL (e.g., "https://cursor.com/.well-known/oauth-client"). Empty for DCR clients.
    - `clientName` string — Original client name from DCR registration
    - `createdAt` string, date-time, nullable
    - `displayName` string — User-provided custom name (defaults to client_name if not set)
    - `lastUsedAt` string, date-time, nullable
    - `mcpClientId` string — MCP client record ID for AI governance tracking. May be empty for legacy grants.
    - `roleIds` string[], nullable — Role IDs granted to this client - frontend can fetch display names via SearchRoles
    - `userId` string — The user who approved this external client (always populated)
    - `verifiedDomain` string — Verified domain from the client_id URL (e.g., "cursor.com"). Empty for DCR clients.
    - `wellKnownClient` 'WELL_KNOWN_CLIENT_UNSPECIFIED' | 'WELL_KNOWN_CLIENT_UNKNOWN' | 'WELL_KNOWN_CLIENT_CLAUDE_AI' | 'WELL_KNOWN_CLIENT_CLAUDE_DESKTOP' | 'WELL_KNOWN_CLIENT_CLAUDE_CODE' | 'WELL_KNOWN_CLIENT_MCP_INSPECTOR' | 'WELL_KNOWN_CLIENT_CHATGPT' | 'WELL_KNOWN_CLIENT_VSCODE' | 'WELL_KNOWN_CLIENT_CURSOR' | 'WELL_KNOWN_CLIENT_WINDSURF' | 'WELL_KNOWN_CLIENT_ZED' | 'WELL_KNOWN_CLIENT_JETBRAINS' | 'WELL_KNOWN_CLIENT_DOCKER_MCP_TOOLKIT' — The wellKnownClient field.
  - `nextPageToken` string — The nextPageToken field.

---

[API](https://skmtc.net/conductorone/apis/c1-api.md) · [All operations](https://skmtc.net/conductorone/apis/c1-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/conductorone/c1-api/revisions/f2cf3228f366/schema)