> ## Documentation Index > Fetch the complete documentation index at: https://conductorone-muhammad-kumail-native-mcp-tabs-batch.mintlify.site/llms.txt > Use this file to discover all available pages before exploring further. # Search > Search findings using full-text query and filters for severity, state, type, and app. Each Finding row is large (risk factors, evidence, target, tags) — request a small page_size (≤10) to keep responses small. ## OpenAPI ````yaml https://spec.speakeasy.com/conductor-one/conductorone/my-source-with-code-samples post /api/v1/findings/search openapi: 3.1.0 info: description: The C1 API is a HTTP API for managing C1 resources. title: C1 API version: 0.1.0-alpha servers: - description: The C1 API server for the current tenant. url: https://{tenantDomain}.conductor.one variables: tenantDomain: default: example description: The domain of the tenant to use for this request. security: - bearerAuth: [] oauth: [] paths: /api/v1/findings/search: post: tags: - Findings summary: Search description: >- Search findings using full-text query and filters for severity, state, type, and app. Each Finding row is large (risk factors, evidence, target, tags) — request a small page_size (≤10) to keep responses small. operationId: c1.api.finding.v1.FindingSearchService.Search requestBody: content: application/json: schema: $ref: '#/components/schemas/c1.api.finding.v1.FindingSearchRequest' responses: '200': content: application/json: schema: $ref: '#/components/schemas/c1.api.finding.v1.FindingSearchResponse' description: Successful response x-codeSamples: - lang: go label: Search source: "package main\n\nimport(\n\t\"context\"\n\t\"github.com/conductorone/conductorone-sdk-go/pkg/models/shared\"\n\tconductoronesdkgo \"github.com/conductorone/conductorone-sdk-go\"\n\t\"log\"\n)\n\nfunc main() {\n ctx := context.Background()\n\n s := conductoronesdkgo.New(\n conductoronesdkgo.WithSecurity(shared.Security{\n BearerAuth: \"\",\n Oauth: \"\",\n }),\n )\n\n res, err := s.FindingSearch.Search(ctx, nil)\n if err != nil {\n log.Fatal(err)\n }\n if res.FindingSearchResponse != nil {\n // handle response\n }\n}" - lang: typescript label: Typescript (SDK) source: >- import { ConductoroneSDKTypescript } from "conductorone-sdk-typescript"; const conductoroneSDKTypescript = new ConductoroneSDKTypescript({ security: { bearerAuth: "", oauth: "", }, }); async function run() { const result = await conductoroneSDKTypescript.findingSearch.search(); console.log(result); } run(); components: schemas: c1.api.finding.v1.FindingSearchRequest: description: The FindingSearchRequest message. properties: appIds: description: Filter by app IDs (OR within field). items: type: string type: - array - 'null' appResourceIds: description: |- Filter by app resource IDs (OR within field). Matches findings whose target.app_resource_target.app_resource_id is in this list. An app resource is app-scoped, so pair with app_ids (and app_resource_type_ids) to hit the composite (tenant_id, app_id, app_resource_type_id, app_resource_id) index. items: type: string type: - array - 'null' appResourceTraitIds: description: >- Filter to findings whose target resource's type carries any of these traits (e.g. the builtin agent / secret trait ids). OR within field; empty = not applied. items: type: string type: - array - 'null' appResourceTypeIds: description: >- Filter by app resource type IDs (OR within field). Matches findings whose target.app_resource_target.app_resource_type_id is in this list. items: type: string type: - array - 'null' appUserIds: description: |- Filter by app user IDs (OR within field). Matches findings whose target.app_user_target.app_user_id is in this list. items: type: string type: - array - 'null' appUserTypes: description: >- Filter to findings whose target is an app user of these types (OR within field). Empty = not applied. items: enum: - APP_USER_TYPE_UNSPECIFIED - APP_USER_TYPE_USER - APP_USER_TYPE_SERVICE_ACCOUNT - APP_USER_TYPE_SYSTEM_ACCOUNT type: string x-speakeasy-unknown-values: allow type: - array - 'null' connectorIds: description: |- Filter by connector IDs (OR within field). Matches findings whose target.connector_target.connector_id is in this list. items: type: string type: - array - 'null' customSubTypes: description: >- Filter by custom sub-type (OR within field). Matches custom findings whose custom_sub_type equals any listed value. items: type: string type: - array - 'null' decoyIds: description: |- Filter by decoy IDs (OR within field). Matches findings whose target.decoy_target.decoy_id is in this list. items: type: string type: - array - 'null' findingTypes: description: Filter by finding type (OR within field). items: enum: - FINDING_TYPE_UNSPECIFIED - FINDING_TYPE_SIMILAR_USERNAME_MATCH - FINDING_TYPE_SERVICE_ACCOUNT_MISCLASSIFICATION - FINDING_TYPE_NHI_UNOWNED - FINDING_TYPE_SERVICE_ACCOUNT_UNOWNED - FINDING_TYPE_DECOY_CREDENTIAL_USED - FINDING_TYPE_CUSTOM - FINDING_TYPE_CONNECTOR_ANOMALY_DETECTION_DISABLED type: string x-speakeasy-unknown-values: allow type: - array - 'null' includeUnassigned: description: >- When true, includes findings with no effective identity-user owner. An explicit predicate for direct API callers who prefer a bool over the "unassigned" sentinel in owner_identity_user_ids; both signals are accepted. type: boolean nhiTypes: description: >- Filter to findings whose target resource's nhi_type is one of these (OR within field). Empty = not applied; pass all NhiType values to match any nhi resource. items: enum: - NHI_TYPE_UNSPECIFIED - NHI_TYPE_APP_REGISTRATION - NHI_TYPE_ASSUMABLE_ROLE - NHI_TYPE_MANAGED_IDENTITY type: string x-speakeasy-unknown-values: allow type: - array - 'null' ownerIdentityUserIds: description: >- Filter by effective owner identity-user IDs (OR within field). Matches findings whose effective owner (assigned_owner if set, else computed_owner) resolves to an identity user in this list. The reserved "unassigned" sentinel token selects findings with no effective identity-user owner; real identity-user IDs are exactly 27 alphanumerics so the token cannot collide. items: type: string type: - array - 'null' pageSize: description: Maximum number of findings to return per page. format: int32 type: integer pageToken: description: Pagination token from a previous response. type: string query: description: Free text search query. type: string refs: description: >- Restrict results to these finding refs by ID (OR within field). Backs the websocket-notify re-query, which refetches just the changed finding(s) to patch a row in place or detect it dropping out of the filter; empty = not applied. Hits the (tenant_id, id) primary key. items: $ref: '#/components/schemas/c1.api.finding.v1.FindingRef' type: - array - 'null' scopeToAppOwner: description: >- When true, restricts results to findings for apps you own. The caller is resolved from request credentials (no user id is read from the request), so results are always limited to your own apps. type: boolean severities: description: Filter by severities (OR within field). items: enum: - FINDING_SEVERITY_UNSPECIFIED - FINDING_SEVERITY_INFO - FINDING_SEVERITY_LOW - FINDING_SEVERITY_MEDIUM - FINDING_SEVERITY_HIGH - FINDING_SEVERITY_CRITICAL type: string x-speakeasy-unknown-values: allow type: - array - 'null' sourceKinds: description: Filter by source kind (OR within field). items: enum: - FINDING_SOURCE_KIND_UNSPECIFIED - FINDING_SOURCE_KIND_DETECTOR - FINDING_SOURCE_KIND_EXTERNAL type: string x-speakeasy-unknown-values: allow type: - array - 'null' states: description: Filter by states (OR within field). items: enum: - FINDING_STATE_UNSPECIFIED - FINDING_STATE_OPEN - FINDING_STATE_IN_PROGRESS - FINDING_STATE_RESOLVED - FINDING_STATE_SNOOZED - FINDING_STATE_RISK_ACCEPTED - FINDING_STATE_SUPPRESSED type: string x-speakeasy-unknown-values: allow type: - array - 'null' title: Finding Search Request type: object x-speakeasy-name-override: FindingSearchRequest c1.api.finding.v1.FindingSearchResponse: description: The FindingSearchResponse message. properties: list: description: The list field. items: $ref: '#/components/schemas/c1.api.finding.v1.Finding' type: - array - 'null' nextPageToken: description: The nextPageToken field. type: string title: Finding Search Response type: object x-speakeasy-name-override: FindingSearchResponse c1.api.finding.v1.FindingRef: description: The FindingRef message. properties: id: description: The ID of the finding. type: string title: Finding Ref type: object x-speakeasy-name-override: FindingRef c1.api.finding.v1.Finding: description: > The Finding message. This message contains a oneof named finding_type. Only a single field of the following list may be set at a time: - similarUsernameMatch - serviceAccountMisclassification - nhiUnowned - serviceAccountUnowned - decoyCredentialUsed - custom - connectorAnomalyDetectionDisabled This message contains a oneof named target. Only a single field of the following list may be set at a time: - identityUserTarget - appUserTarget - decoyTarget - appResourceTarget - tenantTarget - connectorTarget This message contains a oneof named evidence. Only a single field of the following list may be set at a time: - similarUsernameMatchEvidence - serviceAccountMisclassificationEvidence properties: appId: description: The appId field. type: string appResourceTarget: oneOf: - $ref: '#/components/schemas/c1.api.finding.v1.AppResourceTarget' - type: 'null' appUserTarget: oneOf: - $ref: '#/components/schemas/c1.api.finding.v1.AppUserTarget' - type: 'null' assignedOwner: oneOf: - $ref: '#/components/schemas/c1.api.finding.v1.FindingOwnerRef' - type: 'null' computedOwner: oneOf: - $ref: '#/components/schemas/c1.api.finding.v1.FindingOwnerRef' - type: 'null' connectorAnomalyDetectionDisabled: oneOf: - $ref: >- #/components/schemas/c1.api.finding.v1.ConnectorAnomalyDetectionDisabledType - type: 'null' connectorTarget: oneOf: - $ref: '#/components/schemas/c1.api.finding.v1.ConnectorTarget' - type: 'null' createdAt: format: date-time type: - string - 'null' custom: oneOf: - $ref: '#/components/schemas/c1.api.finding.v1.CustomFindingType' - type: 'null' customSubType: description: >- User-supplied sub-classification for custom findings (e.g. "shadow_it"). type: string customTags: additionalProperties: type: string description: The customTags field. type: object decoyCredentialUsed: oneOf: - $ref: '#/components/schemas/c1.api.finding.v1.DecoyCredentialUsedType' - type: 'null' decoyTarget: oneOf: - $ref: '#/components/schemas/c1.api.finding.v1.DecoyTarget' - type: 'null' dedupKeyParts: description: >- Caller-supplied dedup identity for custom findings; echoed back so IaC clients can roundtrip it. Empty for detector findings. items: type: string type: - array - 'null' description: description: >- User-authored finding body (markdown by convention). Set for custom findings. type: string fingerprint: description: The fingerprint field. type: string firstObservedAt: format: date-time type: - string - 'null' id: description: The id field. type: string identityUserTarget: oneOf: - $ref: '#/components/schemas/c1.api.finding.v1.IdentityUserTarget' - type: 'null' lastAppearedAt: format: date-time type: - string - 'null' lastObservedAt: format: date-time type: - string - 'null' nhiUnowned: oneOf: - $ref: '#/components/schemas/c1.api.finding.v1.NhiUnownedType' - type: 'null' recurrenceCount: description: The recurrenceCount field. format: uint32 type: integer remediationDescription: description: The remediationDescription field. type: string resolvedAt: format: date-time type: - string - 'null' riskAcceptanceExpiresAt: format: date-time type: - string - 'null' riskAcceptanceJustification: description: The riskAcceptanceJustification field. type: string riskScore: oneOf: - $ref: '#/components/schemas/c1.api.finding.v1.FindingRiskScore' - type: 'null' serviceAccountMisclassification: oneOf: - $ref: >- #/components/schemas/c1.api.finding.v1.ServiceAccountMisclassificationType - type: 'null' serviceAccountMisclassificationEvidence: oneOf: - $ref: >- #/components/schemas/c1.api.finding.v1.ServiceAccountMisclassificationEvidence - type: 'null' serviceAccountUnowned: oneOf: - $ref: '#/components/schemas/c1.api.finding.v1.ServiceAccountUnownedType' - type: 'null' severity: description: The severity field. enum: - FINDING_SEVERITY_UNSPECIFIED - FINDING_SEVERITY_INFO - FINDING_SEVERITY_LOW - FINDING_SEVERITY_MEDIUM - FINDING_SEVERITY_HIGH - FINDING_SEVERITY_CRITICAL type: string x-speakeasy-unknown-values: allow similarUsernameMatch: oneOf: - $ref: '#/components/schemas/c1.api.finding.v1.SimilarUsernameMatchType' - type: 'null' similarUsernameMatchEvidence: oneOf: - $ref: >- #/components/schemas/c1.api.finding.v1.SimilarUsernameMatchEvidence - type: 'null' snoozeReason: description: The snoozeReason field. type: string snoozeUntil: format: date-time type: - string - 'null' sourceDetectorId: description: The sourceDetectorId field. type: string sourceKind: description: Who authored the finding (detector, user, external). enum: - FINDING_SOURCE_KIND_UNSPECIFIED - FINDING_SOURCE_KIND_DETECTOR - FINDING_SOURCE_KIND_EXTERNAL type: string x-speakeasy-unknown-values: allow state: description: The state field. enum: - FINDING_STATE_UNSPECIFIED - FINDING_STATE_OPEN - FINDING_STATE_IN_PROGRESS - FINDING_STATE_RESOLVED - FINDING_STATE_SNOOZED - FINDING_STATE_RISK_ACCEPTED - FINDING_STATE_SUPPRESSED type: string x-speakeasy-unknown-values: allow stateUpdatedById: description: The stateUpdatedById field. type: string suppressReason: description: The suppressReason field. type: string taskId: description: The taskId field. type: string tenantTarget: oneOf: - $ref: '#/components/schemas/c1.api.finding.v1.TenantTarget' - type: 'null' updatedAt: format: date-time type: - string - 'null' title: Finding type: object x-speakeasy-name-override: Finding c1.api.finding.v1.AppResourceTarget: description: AppResourceTarget points at the app resource the finding is about. properties: appId: description: The appId field. type: string appResourceId: description: The appResourceId field. type: string appResourceTypeId: description: The appResourceTypeId field. type: string title: App Resource Target type: object x-speakeasy-name-override: AppResourceTarget c1.api.finding.v1.AppUserTarget: description: The AppUserTarget message. properties: appId: description: The appId field. type: string appUserId: description: The appUserId field. type: string title: App User Target type: object x-speakeasy-name-override: AppUserTarget c1.api.finding.v1.FindingOwnerRef: description: > The FindingOwnerRef message. This message contains a oneof named owner. Only a single field of the following list may be set at a time: - identityUserId - appOwnerAppId - managerOfUserId - userSetId properties: appOwnerAppId: description: >- The appOwnerAppId field. This field is part of the `owner` oneof. See the documentation for `c1.api.finding.v1.FindingOwnerRef` for more details. type: - string - 'null' identityUserId: description: >- The identityUserId field. This field is part of the `owner` oneof. See the documentation for `c1.api.finding.v1.FindingOwnerRef` for more details. type: - string - 'null' managerOfUserId: description: >- The managerOfUserId field. This field is part of the `owner` oneof. See the documentation for `c1.api.finding.v1.FindingOwnerRef` for more details. type: - string - 'null' userSetId: description: >- The userSetId field. This field is part of the `owner` oneof. See the documentation for `c1.api.finding.v1.FindingOwnerRef` for more details. type: - string - 'null' title: Finding Owner Ref type: object x-speakeasy-name-override: FindingOwnerRef c1.api.finding.v1.ConnectorAnomalyDetectionDisabledType: description: |- ConnectorAnomalyDetectionDisabledType: a connector has sync anomaly detection turned off, so a sudden drop in synced data will not trip the circuit breaker. Target: ConnectorTarget. title: Connector Anomaly Detection Disabled Type type: object x-speakeasy-name-override: ConnectorAnomalyDetectionDisabledType c1.api.finding.v1.ConnectorTarget: description: ConnectorTarget points at the connector that produced this finding. properties: appId: description: The appId field. type: string connectorId: description: The connectorId field. type: string title: Connector Target type: object x-speakeasy-name-override: ConnectorTarget c1.api.finding.v1.CustomFindingType: description: >- CustomFindingType: a user- or integration-authored finding. The discriminator carries no payload; the finding's content lives in description / remediation_description / custom_tags. title: Custom Finding Type type: object x-speakeasy-name-override: CustomFindingType c1.api.finding.v1.DecoyCredentialUsedType: description: |- DecoyCredentialUsedType: a planted decoy credential authenticated successfully. properties: decoyId: description: The decoyId field. type: string kind: description: The kind field. enum: - DECOY_CREDENTIAL_KIND_UNSPECIFIED - DECOY_CREDENTIAL_KIND_USER_CLIENT_CREDENTIAL - DECOY_CREDENTIAL_KIND_CONNECTOR_CLIENT - DECOY_CREDENTIAL_KIND_WORKLOAD_FEDERATION - DECOY_CREDENTIAL_KIND_ACCESS_TOKEN type: string x-speakeasy-unknown-values: allow title: Decoy Credential Used Type type: object x-speakeasy-name-override: DecoyCredentialUsedType c1.api.finding.v1.DecoyTarget: description: |- DecoyTarget points at the planted decoy that produced this finding. Populated for findings whose subject is the decoy artifact itself (e.g. decoy_credential_used), giving the UI and routing rules a uniform handle to the decoy alongside the finding_type payload. properties: decoyId: description: The decoyId field. type: string title: Decoy Target type: object x-speakeasy-name-override: DecoyTarget c1.api.finding.v1.IdentityUserTarget: description: The IdentityUserTarget message. properties: identityUserId: description: The identityUserId field. type: string title: Identity User Target type: object x-speakeasy-name-override: IdentityUserTarget c1.api.finding.v1.NhiUnownedType: description: |- NhiUnownedType: an AppResource with a non-human-identity type has no primary owner. Target: AppResourceTarget (the unowned NHI resource). title: Nhi Unowned Type type: object x-speakeasy-name-override: NhiUnownedType c1.api.finding.v1.FindingRiskScore: description: The FindingRiskScore message. properties: originalScore: description: The originalScore field. format: uint32 type: integer overrideByUserId: description: The overrideByUserId field. type: string overrideScore: description: The overrideScore field. format: uint32 type: integer riskFactors: description: The riskFactors field. items: $ref: '#/components/schemas/c1.api.finding.v1.FindingRiskFactor' type: - array - 'null' score: description: The score field. format: uint32 type: integer systemScore: description: The systemScore field. format: uint32 type: integer title: Finding Risk Score type: object x-speakeasy-name-override: FindingRiskScore c1.api.finding.v1.ServiceAccountMisclassificationType: description: The ServiceAccountMisclassificationType message. properties: currentAccountType: description: The currentAccountType field. enum: - APP_USER_TYPE_UNSPECIFIED - APP_USER_TYPE_USER - APP_USER_TYPE_SERVICE_ACCOUNT - APP_USER_TYPE_SYSTEM_ACCOUNT type: string x-speakeasy-unknown-values: allow detectedAccountType: description: The detectedAccountType field. enum: - APP_USER_TYPE_UNSPECIFIED - APP_USER_TYPE_USER - APP_USER_TYPE_SERVICE_ACCOUNT - APP_USER_TYPE_SYSTEM_ACCOUNT type: string x-speakeasy-unknown-values: allow title: Service Account Misclassification Type type: object x-speakeasy-name-override: ServiceAccountMisclassificationType c1.api.finding.v1.ServiceAccountMisclassificationEvidence: description: The ServiceAccountMisclassificationEvidence message. properties: detectionReason: description: The detectionReason field. type: string title: Service Account Misclassification Evidence type: object x-speakeasy-name-override: ServiceAccountMisclassificationEvidence c1.api.finding.v1.ServiceAccountUnownedType: description: |- ServiceAccountUnownedType: a service-account-classified AppUser has no primary owner. Target: AppUserTarget (the unowned service account). title: Service Account Unowned Type type: object x-speakeasy-name-override: ServiceAccountUnownedType c1.api.finding.v1.SimilarUsernameMatchType: description: The SimilarUsernameMatchType message. properties: proposedIdentityUserId: description: The proposedIdentityUserId field. type: string title: Similar Username Match Type type: object x-speakeasy-name-override: SimilarUsernameMatchType c1.api.finding.v1.SimilarUsernameMatchEvidence: description: The SimilarUsernameMatchEvidence message. properties: appUsername: description: The appUsername field. type: string identityUsername: description: The identityUsername field. type: string similarityScore: description: The similarityScore field. type: number title: Similar Username Match Evidence type: object x-speakeasy-name-override: SimilarUsernameMatchEvidence c1.api.finding.v1.TenantTarget: description: >- TenantTarget scopes a finding to the whole tenant. It carries no subject id; the finding's tenant is the scope. title: Tenant Target type: object x-speakeasy-name-override: TenantTarget c1.api.finding.v1.FindingRiskFactor: description: The FindingRiskFactor message. properties: description: description: The description field. type: string name: description: The name field. type: string severity: description: The severity field. enum: - FINDING_SEVERITY_UNSPECIFIED - FINDING_SEVERITY_INFO - FINDING_SEVERITY_LOW - FINDING_SEVERITY_MEDIUM - FINDING_SEVERITY_HIGH - FINDING_SEVERITY_CRITICAL type: string x-speakeasy-unknown-values: allow weight: description: The weight field. format: uint32 type: integer title: Finding Risk Factor type: object x-speakeasy-name-override: FindingRiskFactor securitySchemes: bearerAuth: scheme: bearer type: http oauth: description: >- This API uses OAuth2 with the Client Credential flow. Client Credentials must be sent in the BODY, not the headers. For an example of how to implement this, refer to the [c1TokenSource.Token()](https://github.com/ConductorOne/conductorone-sdk-go/blob/3375fe7c0126d17e7ec4e711693dee7b791023aa/token_source.go#L101-L187) function. flows: clientCredentials: scopes: {} tokenUrl: /auth/v1/token type: oauth2 ````