---
title: "Search"
method: POST
path: "/api/v1/search/ssf-receiver-events"
tags: ["SSF Receiver"]
---

# Search

`POST /api/v1/search/ssf-receiver-events`

Search performs a full-text search across received SSF events with optional filters for stream, event type, outcome, and matched user.
 Request a modest page_size (≤25) to keep responses small.

## Request body

- C1ApiSsfReceiverV1SSFReceiverEventSearchServiceSearchRequest — SSFReceiverEventSearchServiceSearchRequest carries the search query and optional filters for narrowing results.
  - `eventType` string — Restricts results to events matching this wire event type URI. Optional.
  - `matchedUserId` string — Restricts results to events matched to this ConductorOne user ID. Optional.
  - `outcome` 'SSF_EVENT_OUTCOME_UNSPECIFIED' | 'SSF_EVENT_OUTCOME_SESSIONS_REVOKED' | 'SSF_EVENT_OUTCOME_LOGGED' | 'SSF_EVENT_OUTCOME_PRINCIPAL_NOT_FOUND' | 'SSF_EVENT_OUTCOME_VERIFIED' | 'SSF_EVENT_OUTCOME_STREAM_STATUS_UPDATED' | 'SSF_EVENT_OUTCOME_UNRECOGNIZED' | 'SSF_EVENT_OUTCOME_ERROR' — Restricts results to events with this processing outcome. Optional.
  - `pageSize` integer — Maximum number of events to return per page.
  - `pageToken` string — Token from a previous SearchResponse to fetch the next page of results.
  - `query` string — Full-text search query matched against event fields.
  - `streamId` string — Restricts results to events from this SSF receiver stream. Optional.

## Response `200`

SSFReceiverEventSearchServiceSearchResponse contains the matching events and a pagination token.

- C1ApiSsfReceiverV1SSFReceiverEventSearchServiceSearchResponse — SSFReceiverEventSearchServiceSearchResponse contains the matching events and a pagination token.
  - `list` C1ApiSsfReceiverV1SSFReceiverEvent[], nullable — The SSF events matching the search criteria.
    - `canonicalType` 'SSF_CANONICAL_EVENT_TYPE_UNSPECIFIED' | 'SSF_CANONICAL_EVENT_TYPE_UNRECOGNIZED' | 'SSF_CANONICAL_EVENT_TYPE_SESSION_REVOKED' | 'SSF_CANONICAL_EVENT_TYPE_CREDENTIAL_CHANGED' | 'SSF_CANONICAL_EVENT_TYPE_TOKEN_CLAIMS_CHANGED' | 'SSF_CANONICAL_EVENT_TYPE_ASSURANCE_LEVEL_CHANGED' | 'SSF_CANONICAL_EVENT_TYPE_DEVICE_COMPLIANCE_CHANGED' | 'SSF_CANONICAL_EVENT_TYPE_RISK_LEVEL_CHANGED' | 'SSF_CANONICAL_EVENT_TYPE_SESSION_ESTABLISHED' | 'SSF_CANONICAL_EVENT_TYPE_SESSION_PRESENTED' | 'SSF_CANONICAL_EVENT_TYPE_ACCOUNT_DISABLED' | 'SSF_CANONICAL_EVENT_TYPE_ACCOUNT_ENABLED' | 'SSF_CANONICAL_EVENT_TYPE_ACCOUNT_PURGED' | 'SSF_CANONICAL_EVENT_TYPE_CREDENTIAL_COMPROMISE' | 'SSF_CANONICAL_EVENT_TYPE_RECOVERY_ACTIVATED' | 'SSF_CANONICAL_EVENT_TYPE_IDENTIFIER_CHANGED' | 'SSF_CANONICAL_EVENT_TYPE_VERIFICATION' | 'SSF_CANONICAL_EVENT_TYPE_STREAM_UPDATED' — C1 canonical outcome (what C1 understood and did). The normalized event type after mapping from the wire event type.
    - `id` string — The unique identifier of this event.
    - `matchMethod` 'SSF_SUBJECT_MATCH_METHOD_UNSPECIFIED' | 'SSF_SUBJECT_MATCH_METHOD_IDP_USER' | 'SSF_SUBJECT_MATCH_METHOD_EMAIL' | 'SSF_SUBJECT_MATCH_METHOD_NOT_FOUND' | 'SSF_SUBJECT_MATCH_METHOD_NOT_APPLICABLE' — How the upstream subject was resolved to a ConductorOne user.
    - `matchedUserId` string — The ConductorOne user ID that the event subject was resolved to, if any.
    - `outcome` 'SSF_EVENT_OUTCOME_UNSPECIFIED' | 'SSF_EVENT_OUTCOME_SESSIONS_REVOKED' | 'SSF_EVENT_OUTCOME_LOGGED' | 'SSF_EVENT_OUTCOME_PRINCIPAL_NOT_FOUND' | 'SSF_EVENT_OUTCOME_VERIFIED' | 'SSF_EVENT_OUTCOME_STREAM_STATUS_UPDATED' | 'SSF_EVENT_OUTCOME_UNRECOGNIZED' | 'SSF_EVENT_OUTCOME_ERROR' — The action ConductorOne took in response to this event.
    - `outcomeDetail` string — Human-readable details about the outcome (e.g., error message or revocation summary).
    - `receivedAt` string, date-time, nullable
    - `sessionsRevoked` integer — Number of sessions that were revoked as a result of this event.
    - `setJti` string — Wire-level data (what the transmitter sent). The SET (Security Event Token) JWT ID claim, uniquely identifying the token.
    - `streamId` string — The SSF receiver stream that received this event.
    - `wireEventProfile` string — The event profile URI from the SET, if present.
    - `wireEventType` string — The raw event type URI from the SET (e.g., "https://schemas.openid.net/secevent/caep/event-type/session-revoked").
    - `wireInitiatingEntity` string — The entity that initiated the event, as reported by the transmitter.
    - `wireReasonAdmin` string — The admin-facing reason string from the SET, if provided by the transmitter.
    - `wireSubjectFormat` string — The subject identifier format from the SET (e.g., "email", "iss_sub").
    - `wireSubjectIdentifier` string — The raw subject identifier value from the SET.
  - `nextPageToken` string — Token to retrieve the next page. Empty when there are no more results.

---

[API](https://skmtc.net/conductorone/apis/c1-api.md) · [All operations](https://skmtc.net/conductorone/apis/c1-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/conductorone/c1-api/revisions/f2cf3228f366/schema)