--- title: "Search" method: POST path: "/api/v1/search/session-policies" tags: ["Session Policy"] --- # Search `POST /api/v1/search/session-policies` Search session policies by name, or fetch a specific set by ID. Returns one page of matching policies at a time. ## Request body - C1ApiSessionPolicyV1SessionPolicyServiceSearchRequest — The SessionPolicyServiceSearchRequest message. - `pageSize` integer — The pageSize field. - `pageToken` string — The pageToken field. - `query` string — Free-text search over the policy name. Empty matches all policies. - `refs` C1ApiSessionPolicyV1SessionPolicyRef[], nullable — Restrict results to these specific policies. Empty matches all policies. - `id` string — The id field. ## Response `200` Successful response - C1ApiSessionPolicyV1SessionPolicyServiceSearchResponse — The SessionPolicyServiceSearchResponse message. - `list` C1ApiSessionPolicyV1SessionPolicy[], nullable — The list field. - `accessTokenTtlSeconds` integer — How long an access token is valid, in seconds. - `continuousDefaultOutcome` C1ApiSessionPolicyV1PolicyOutcome — PolicyOutcome is the effect of a matched rule. Exactly one kind is set. For session continuous-evaluation, the meaningful kinds are Allow (continue), Deny (terminate), and StepUpRequired. This message contains a oneof named kind. Only a single field of the following list may be set at a time: - allow - deny - stepUpRequired - challengeRequired - enrollmentRequired - `allow` C1ApiSessionPolicyV1Allow — Allow continues the session. - `floorLevel` 'AUTH_LEVEL_UNSPECIFIED' | 'AUTH_LEVEL_NONE' | 'AUTH_LEVEL_SINGLE_FACTOR' | 'AUTH_LEVEL_MULTI_FACTOR' | 'AUTH_LEVEL_PHR' | 'AUTH_LEVEL_PHRH' — The minimum assurance level that satisfies this rule. - `challengeRequired` C1ApiSessionPolicyV1ChallengeRequired — ChallengeRequired asks for an additional factor. - `types` string[], nullable — The types field. - `deny` C1ApiSessionPolicyV1Deny — Deny terminates the session. - `reasonAdmin` string — Reason shown in admin-only audit. - `reasonUser` string — Reason safe to show the end user. - `enrollmentRequired` C1ApiSessionPolicyV1EnrollmentRequired — EnrollmentRequired tells the user to enroll a credential before continuing. - `credentialTypes` string[], nullable — The credentialTypes field. - `stepUpRequired` C1ApiSessionPolicyV1StepUpRequired — StepUpRequired demands a stronger re-authentication before the session may continue. - `level` 'AUTH_LEVEL_UNSPECIFIED' | 'AUTH_LEVEL_NONE' | 'AUTH_LEVEL_SINGLE_FACTOR' | 'AUTH_LEVEL_MULTI_FACTOR' | 'AUTH_LEVEL_PHR' | 'AUTH_LEVEL_PHRH' — The level field. - `maxAgeSeconds` integer — How fresh the step-up must be, in seconds. - `types` string[], nullable — The types field. - `continuousRules` C1ApiSessionPolicyV1PolicyRule[], nullable — The continuous-evaluation rule cascade, re-checked on every request and on inbound shared-signals events. - `description` string — The description field. - `id` string — The id field. - `matchCel` string — The matchCel field. - `mode` 'POLICY_RULE_MODE_UNSPECIFIED' | 'POLICY_RULE_MODE_ENFORCE' | 'POLICY_RULE_MODE_OBSERVE' | 'POLICY_RULE_MODE_DISABLED' — The mode field. - `outcome` C1ApiSessionPolicyV1PolicyOutcome — PolicyOutcome is the effect of a matched rule. Exactly one kind is set. For session continuous-evaluation, the meaningful kinds are Allow (continue), Deny (terminate), and StepUpRequired. This message contains a oneof named kind. Only a single field of the following list may be set at a time: - allow - deny - stepUpRequired - challengeRequired - enrollmentRequired - `allow` C1ApiSessionPolicyV1Allow — Allow continues the session. - `floorLevel` 'AUTH_LEVEL_UNSPECIFIED' | 'AUTH_LEVEL_NONE' | 'AUTH_LEVEL_SINGLE_FACTOR' | 'AUTH_LEVEL_MULTI_FACTOR' | 'AUTH_LEVEL_PHR' | 'AUTH_LEVEL_PHRH' — The minimum assurance level that satisfies this rule. - `challengeRequired` C1ApiSessionPolicyV1ChallengeRequired — ChallengeRequired asks for an additional factor. - `types` string[], nullable — The types field. - `deny` C1ApiSessionPolicyV1Deny — Deny terminates the session. - `reasonAdmin` string — Reason shown in admin-only audit. - `reasonUser` string — Reason safe to show the end user. - `enrollmentRequired` C1ApiSessionPolicyV1EnrollmentRequired — EnrollmentRequired tells the user to enroll a credential before continuing. - `credentialTypes` string[], nullable — The credentialTypes field. - `stepUpRequired` C1ApiSessionPolicyV1StepUpRequired — StepUpRequired demands a stronger re-authentication before the session may continue. - `level` 'AUTH_LEVEL_UNSPECIFIED' | 'AUTH_LEVEL_NONE' | 'AUTH_LEVEL_SINGLE_FACTOR' | 'AUTH_LEVEL_MULTI_FACTOR' | 'AUTH_LEVEL_PHR' | 'AUTH_LEVEL_PHRH' — The level field. - `maxAgeSeconds` integer — How fresh the step-up must be, in seconds. - `types` string[], nullable — The types field. - `createdAt` string, date-time, nullable - `credentialDurations` C1ApiSessionPolicyV1PerCredentialDuration[], nullable — Per-credential-type lifetime overrides. - `accessTokenTtlSeconds` integer — Access-token lifetime for this credential type, in seconds. - `credentialType` 'CREDENTIAL_TYPE_UNSPECIFIED' | 'CREDENTIAL_TYPE_PASSKEY' | 'CREDENTIAL_TYPE_PASSWORD' | 'CREDENTIAL_TYPE_TOTP' | 'CREDENTIAL_TYPE_EMAIL_OTP' | 'CREDENTIAL_TYPE_RECOVERY_CODE' | 'CREDENTIAL_TYPE_DELEGATED_GOOGLE' | 'CREDENTIAL_TYPE_DELEGATED_MICROSOFT' | 'CREDENTIAL_TYPE_UPSTREAM_IDP' — The credentialType field. - `maxSessionDurationSeconds` integer — Maximum total session duration for this credential type, in seconds. - `deletedAt` string, date-time, nullable - `displayName` string — A human-readable name for the policy. - `id` string — Unique identifier for the policy. - `idleTimeoutSeconds` integer — How long a session may be idle before it ends, in seconds. - `isBuiltin` boolean — True for built-in policies provided by ConductorOne. Built-in policies cannot be edited or deleted. - `maxSessionDurationSeconds` integer — The maximum total lifetime of a session, in seconds. - `persistence` 'PERSISTENCE_MODE_UNSPECIFIED' | 'PERSISTENCE_MODE_ALLOW_USER_CHOICE' | 'PERSISTENCE_MODE_ALWAYS_PERSIST' | 'PERSISTENCE_MODE_SESSION_ONLY' — Whether sessions may persist across browser restarts. - `priority` integer — When a user matches more than one policy, the policy with the highest priority applies. - `refreshRotationWindowSeconds` integer — Grace window after rotation during which the previous refresh token is still accepted, in seconds (covers in-flight client retries). - `refreshTokenTtlSeconds` integer — How long a refresh token is valid, in seconds. - `rotateRefreshOnUse` boolean — Whether to issue a new refresh token each time one is used. - `ssfReceive` C1ApiSessionPolicyV1SSFReceiverConfig — SSFReceiverConfig selects which inbound shared-signals streams this session trusts. Each stream's issuer, keys, expected audience, and per-event actions are configured on the stream itself; this policy just lists the stream IDs. - `enabled` boolean — Whether inbound shared-signals consumption is enabled for this policy. - `ssfReceiverStreamIds` string[], nullable — The inbound stream IDs this policy trusts. - `ssfTransmit` C1ApiSessionPolicyV1SSFTransmitterConfig — SSFTransmitterConfig selects which outbound shared-signals streams this session emits security events to. Each stream's delivery endpoint, authentication, and per-event allowlist are configured on the stream itself; this policy just lists the stream IDs and the event types to emit. - `enabled` boolean — Whether outbound shared-signals emission is enabled for this policy. - `eventTypes` string[], nullable — The shared-signals event types to emit at the policy level. - `ssfTransmitterStreamIds` string[], nullable — The outbound stream IDs this policy emits to. - `updatedAt` string, date-time, nullable - `nextPageToken` string — The nextPageToken field. --- [API](https://skmtc.net/conductorone/apis/c1-api.md) · [All operations](https://skmtc.net/conductorone/apis/c1-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/conductorone/c1-api/revisions/f2cf3228f366/schema)