---
title: "Search"
method: POST
path: "/api/v1/findings/search"
tags: ["Findings"]
---

# Search

`POST /api/v1/findings/search`

Search findings using full-text query and filters for severity, state, type, and app.

## Request body

- C1ApiFindingV1FindingSearchRequest — The FindingSearchRequest message.
  - `appIds` string[], nullable — Filter by app IDs (OR within field).
  - `appUserIds` string[], nullable — Filter by app user IDs (OR within field). Matches findings whose target.app_user_target.app_user_id is in this list.
  - `findingTypes` string[], nullable — Filter by finding type (OR within field).
  - `pageSize` integer — Maximum number of findings to return per page.
  - `pageToken` string — Pagination token from a previous response.
  - `query` string — Free text search query.
  - `severities` string[], nullable — Filter by severities (OR within field).
  - `states` string[], nullable — Filter by states (OR within field).

## Response `200`

Successful response

- C1ApiFindingV1FindingSearchResponse — The FindingSearchResponse message.
  - `list` C1ApiFindingV1Finding[], nullable — The list field.
    - `appId` string — The appId field.
    - `appUserTarget` C1ApiFindingV1AppUserTarget, nullable — The AppUserTarget message.
      - `appId` string — The appId field.
      - `appUserId` string — The appUserId field.
    - `assignedOwner` C1ApiFindingV1FindingOwnerRef — The FindingOwnerRef message. This message contains a oneof named owner. Only a single field of the following list may be set at a time: - identityUserId - appOwnerAppId - managerOfUserId - userSetId
      - `appOwnerAppId` string, nullable — The appOwnerAppId field. This field is part of the `owner` oneof. See the documentation for `c1.api.finding.v1.FindingOwnerRef` for more details.
      - `identityUserId` string, nullable — The identityUserId field. This field is part of the `owner` oneof. See the documentation for `c1.api.finding.v1.FindingOwnerRef` for more details.
      - `managerOfUserId` string, nullable — The managerOfUserId field. This field is part of the `owner` oneof. See the documentation for `c1.api.finding.v1.FindingOwnerRef` for more details.
      - `userSetId` string, nullable — The userSetId field. This field is part of the `owner` oneof. See the documentation for `c1.api.finding.v1.FindingOwnerRef` for more details.
    - `computedOwner` C1ApiFindingV1FindingOwnerRef — The FindingOwnerRef message. This message contains a oneof named owner. Only a single field of the following list may be set at a time: - identityUserId - appOwnerAppId - managerOfUserId - userSetId
      - `appOwnerAppId` string, nullable — The appOwnerAppId field. This field is part of the `owner` oneof. See the documentation for `c1.api.finding.v1.FindingOwnerRef` for more details.
      - `identityUserId` string, nullable — The identityUserId field. This field is part of the `owner` oneof. See the documentation for `c1.api.finding.v1.FindingOwnerRef` for more details.
      - `managerOfUserId` string, nullable — The managerOfUserId field. This field is part of the `owner` oneof. See the documentation for `c1.api.finding.v1.FindingOwnerRef` for more details.
      - `userSetId` string, nullable — The userSetId field. This field is part of the `owner` oneof. See the documentation for `c1.api.finding.v1.FindingOwnerRef` for more details.
    - `createdAt` string, date-time
    - `customTags` object — The customTags field.
    - `decoyCredentialUsed` C1ApiFindingV1DecoyCredentialUsedType, nullable — DecoyCredentialUsedType: a planted decoy credential authenticated successfully.
      - `decoyId` string — The decoyId field.
      - `kind` 'DECOY_CREDENTIAL_KIND_UNSPECIFIED' | 'DECOY_CREDENTIAL_KIND_USER_CLIENT_CREDENTIAL' | 'DECOY_CREDENTIAL_KIND_CONNECTOR_CLIENT' | 'DECOY_CREDENTIAL_KIND_WORKLOAD_FEDERATION' | 'DECOY_CREDENTIAL_KIND_ACCESS_TOKEN' — The kind field.
    - `fingerprint` string — The fingerprint field.
    - `firstObservedAt` string, date-time
    - `id` string — The id field.
    - `identityUserTarget` C1ApiFindingV1IdentityUserTarget, nullable — The IdentityUserTarget message.
      - `identityUserId` string — The identityUserId field.
    - `lastObservedAt` string, date-time
    - `recurrenceCount` integer — The recurrenceCount field.
    - `remediationDescription` string — The remediationDescription field.
    - `resolvedAt` string, date-time
    - `riskAcceptanceExpiresAt` string, date-time
    - `riskAcceptanceJustification` string — The riskAcceptanceJustification field.
    - `riskScore` C1ApiFindingV1FindingRiskScore — The FindingRiskScore message.
      - `originalScore` integer — The originalScore field.
      - `overrideByUserId` string — The overrideByUserId field.
      - `overrideScore` integer — The overrideScore field.
      - `riskFactors` C1ApiFindingV1FindingRiskFactor[], nullable — The riskFactors field.
        - `description` string — The description field.
        - `name` string — The name field.
        - `severity` 'FINDING_SEVERITY_UNSPECIFIED' | 'FINDING_SEVERITY_INFO' | 'FINDING_SEVERITY_LOW' | 'FINDING_SEVERITY_MEDIUM' | 'FINDING_SEVERITY_HIGH' | 'FINDING_SEVERITY_CRITICAL' — The severity field.
        - `weight` integer — The weight field.
      - `score` integer — The score field.
      - `systemScore` integer — The systemScore field.
    - `serviceAccountMisclassification` C1ApiFindingV1ServiceAccountMisclassificationType, nullable — The ServiceAccountMisclassificationType message.
      - `currentAccountType` 'APP_USER_TYPE_UNSPECIFIED' | 'APP_USER_TYPE_USER' | 'APP_USER_TYPE_SERVICE_ACCOUNT' | 'APP_USER_TYPE_SYSTEM_ACCOUNT' — The currentAccountType field.
      - `detectedAccountType` 'APP_USER_TYPE_UNSPECIFIED' | 'APP_USER_TYPE_USER' | 'APP_USER_TYPE_SERVICE_ACCOUNT' | 'APP_USER_TYPE_SYSTEM_ACCOUNT' — The detectedAccountType field.
    - `serviceAccountMisclassificationEvidence` C1ApiFindingV1ServiceAccountMisclassificationEvidence, nullable — The ServiceAccountMisclassificationEvidence message.
      - `detectionReason` string — The detectionReason field.
    - `severity` 'FINDING_SEVERITY_UNSPECIFIED' | 'FINDING_SEVERITY_INFO' | 'FINDING_SEVERITY_LOW' | 'FINDING_SEVERITY_MEDIUM' | 'FINDING_SEVERITY_HIGH' | 'FINDING_SEVERITY_CRITICAL' — The severity field.
    - `similarUsernameMatch` C1ApiFindingV1SimilarUsernameMatchType, nullable — The SimilarUsernameMatchType message.
      - `proposedIdentityUserId` string — The proposedIdentityUserId field.
    - `similarUsernameMatchEvidence` C1ApiFindingV1SimilarUsernameMatchEvidence, nullable — The SimilarUsernameMatchEvidence message.
      - `appUsername` string — The appUsername field.
      - `identityUsername` string — The identityUsername field.
      - `similarityScore` number — The similarityScore field.
    - `snoozeReason` string — The snoozeReason field.
    - `snoozeUntil` string, date-time
    - `sourceDetectorId` string — The sourceDetectorId field.
    - `state` 'FINDING_STATE_UNSPECIFIED' | 'FINDING_STATE_OPEN' | 'FINDING_STATE_IN_PROGRESS' | 'FINDING_STATE_RESOLVED' | 'FINDING_STATE_SNOOZED' | 'FINDING_STATE_RISK_ACCEPTED' | 'FINDING_STATE_SUPPRESSED' — The state field.
    - `stateUpdatedById` string — The stateUpdatedById field.
    - `suppressReason` string — The suppressReason field.
    - `taskId` string — The taskId field.
    - `updatedAt` string, date-time
  - `nextPageToken` string — The nextPageToken field.

---

[API](https://skmtc.net/conductorone/apis/c1-api.md) · [All operations](https://skmtc.net/conductorone/apis/c1-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/conductorone/c1-api/revisions/d391405a35d3/schema)