---
title: "Search"
method: POST
path: "/api/v1/search/xaa/scopes"
tags: ["Cross-App Access"]
---

# Search

`POST /api/v1/search/xaa/scopes`

Search scopes across the tenant, filtered by resource server, state,
 classification, source, or text query, or fetch a specific set by ref.
 Filter on PENDING_REVIEW to find scopes awaiting approval.

## Request body

- C1ApiCrossAppAccessV1XAAScopeServiceSearchRequest — XAAScopeServiceSearchRequest searches scopes with filters.
  - `appIds` string[], nullable — Optional filter by applications. Empty matches any application.
  - `classificationFilter` string[], nullable — Optional filter by classification. UNSPECIFIED means no filter.
  - `pageSize` integer — Page size (max 100).
  - `pageToken` string — Page token for pagination.
  - `query` string — Optional text query matched against scope_value and display_name.
  - `refs` C1ApiCrossAppAccessV1XAAScopeRef[], nullable — Optional: fetch a specific set of scopes by ref (used by websocket notify to re-fetch individual rows).
    - `appId` string — The appId field.
    - `id` string — The id field.
  - `sourceFilter` string[], nullable — Optional filter by source. UNSPECIFIED means no filter.
  - `stateFilter` string[], nullable — Optional filter by state. UNSPECIFIED means no filter.
  - `xaaResourceServerIds` string[], nullable — Optional filter by resource servers. Empty matches any resource server.

## Response `200`

XAAScopeServiceSearchResponse returns matching scopes.

- C1ApiCrossAppAccessV1XAAScopeServiceSearchResponse — XAAScopeServiceSearchResponse returns matching scopes.
  - `list` C1ApiCrossAppAccessV1XAAScope[], nullable — Matching scopes.
    - `appEntitlementId` string — The AppEntitlement created for this scope.
    - `appId` string — The application that owns the resource server.
    - `classification` 'XAA_SCOPE_CLASSIFICATION_UNSPECIFIED' | 'XAA_SCOPE_CLASSIFICATION_READ' | 'XAA_SCOPE_CLASSIFICATION_WRITE' | 'XAA_SCOPE_CLASSIFICATION_DESTRUCTIVE' | 'XAA_SCOPE_CLASSIFICATION_SENSITIVE' | 'XAA_SCOPE_CLASSIFICATION_DANGEROUS' — Risk classification.
    - `createdAt` string, date-time, nullable
    - `deletedAt` string, date-time, nullable
    - `description` string — Description of what the scope grants.
    - `displayName` string — Display name for the scope.
    - `id` string — Unique identifier for this scope.
    - `lastDiscoveredAt` string, date-time, nullable
    - `scopeValue` string — The literal OAuth scope string minted into the grant. Immutable after creation (RFC 6749 charset, max 256 bytes).
    - `source` 'XAA_SCOPE_SOURCE_UNSPECIFIED' | 'XAA_SCOPE_SOURCE_ADMIN_DECLARED' | 'XAA_SCOPE_SOURCE_DISCOVERED' — How C1 learned of the scope.
    - `state` 'XAA_SCOPE_STATE_UNSPECIFIED' | 'XAA_SCOPE_STATE_PENDING_REVIEW' | 'XAA_SCOPE_STATE_ENABLED' | 'XAA_SCOPE_STATE_DISABLED' | 'XAA_SCOPE_STATE_REMOVED' — Approval/lifecycle state.
    - `updatedAt` string, date-time, nullable
    - `xaaResourceServerId` string — The resource server this scope belongs to.
  - `nextPageToken` string — Token for the next page.

---

[API](https://skmtc.net/conductorone/apis/c1-api.md) · [All operations](https://skmtc.net/conductorone/apis/c1-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/conductorone/c1-api/revisions/f2cf3228f366/schema)