> ## Documentation Index > Fetch the complete documentation index at: https://conductorone-docs-mcp-bridge-private-server.mintlify.site/llms.txt > Use this file to discover all available pages before exploring further. # Search > Search app entitlements based on filters specified in the request body. ## OpenAPI ````yaml https://spec.speakeasy.com/conductor-one/conductorone/my-source-with-code-samples post /api/v1/search/entitlements openapi: 3.1.0 info: description: The C1 API is a HTTP API for managing C1 resources. title: C1 API version: 0.1.0-alpha servers: - description: The C1 API server for the current tenant. url: https://{tenantDomain}.conductor.one variables: tenantDomain: default: example description: The domain of the tenant to use for this request. security: - bearerAuth: [] oauth: [] paths: /api/v1/search/entitlements: post: tags: - App Entitlement summary: Search description: Search app entitlements based on filters specified in the request body. operationId: c1.api.app.v1.AppEntitlementSearchService.Search requestBody: content: application/json: schema: $ref: >- #/components/schemas/c1.api.app.v1.AppEntitlementSearchServiceSearchRequest responses: '200': content: application/json: schema: $ref: >- #/components/schemas/c1.api.app.v1.AppEntitlementSearchServiceSearchResponse description: Successful response x-codeSamples: - lang: go label: Search source: "package main\n\nimport(\n\t\"context\"\n\t\"github.com/conductorone/conductorone-sdk-go/pkg/models/shared\"\n\tconductoronesdkgo \"github.com/conductorone/conductorone-sdk-go\"\n\t\"log\"\n)\n\nfunc main() {\n ctx := context.Background()\n\n s := conductoronesdkgo.New(\n conductoronesdkgo.WithSecurity(shared.Security{\n BearerAuth: \"\",\n Oauth: \"\",\n }),\n )\n\n res, err := s.AppEntitlementSearch.Search(ctx, nil)\n if err != nil {\n log.Fatal(err)\n }\n if res.AppEntitlementSearchServiceSearchResponse != nil {\n for {\n // handle items\n\n res, err = res.Next()\n\n if err != nil {\n // handle error\n }\n\n if res == nil {\n break\n }\n }\n }\n}" - lang: typescript label: Typescript (SDK) source: >- import { ConductoroneSDKTypescript } from "conductorone-sdk-typescript"; const conductoroneSDKTypescript = new ConductoroneSDKTypescript({ security: { bearerAuth: "", oauth: "", }, }); async function run() { const result = await conductoroneSDKTypescript.appEntitlementSearch.search(); for await (const page of result) { console.log(page); } } run(); components: schemas: c1.api.app.v1.AppEntitlementSearchServiceSearchRequest: description: Search app entitlements by a variety of filters. properties: accessReviewId: description: >- Search for app entitlements that are being reviewed as part of this access review campaign. type: - string - 'null' alias: description: Search for app entitlements that have this alias (exact match). type: - string - 'null' appIds: description: Search for app entitlements contained in any of these apps. items: type: string type: - array - 'null' appUserIds: description: >- Search for app entitlements that are granted to any of these app user ids. items: type: string type: - array - 'null' complianceFrameworkIds: description: >- Search for app entitlements that are part of these compliance frameworks. items: type: string type: - array - 'null' displayName: description: Filter results to entitlements with this exact display name. type: - string - 'null' excludeAppIds: description: Exclude app entitlements from the results that are in these app IDs. items: type: string type: - array - 'null' excludeAppUserIds: description: >- Exclude entitlements from results that are granted to any of these app users. items: type: string type: - array - 'null' excludeImmutable: description: >- If true, exclude immutable entitlements (e.g., system-managed entitlements that cannot be modified). type: - boolean - 'null' excludeResourceTypeIds: description: >- Exclude entitlements with any of these resource type IDs from results. items: type: string type: - array - 'null' excludedEntitlementRefs: description: Exclude these specific entitlements from results. items: $ref: '#/components/schemas/c1.api.app.v1.AppEntitlementRef' type: - array - 'null' expandMask: oneOf: - $ref: '#/components/schemas/c1.api.app.v1.AppEntitlementExpandMask' - type: 'null' includeDeleted: description: >- Include deleted app entitlements, this includes app entitlements that have a deleted parent object (app, app resource, app resource type) type: - boolean - 'null' isAutomated: description: >- If true, restrict results to entitlements that have an automation rule configured. type: - boolean - 'null' membershipType: description: >- Filter results to entitlements where the user has any of these membership types (e.g., member, owner, admin). items: enum: - APP_ENTITLEMENT_MEMBERSHIP_TYPE_UNSPECIFIED - APP_ENTITLEMENT_MEMBERSHIP_TYPE_MEMBER - APP_ENTITLEMENT_MEMBERSHIP_TYPE_OWNER - APP_ENTITLEMENT_MEMBERSHIP_TYPE_EXCLUSION - APP_ENTITLEMENT_MEMBERSHIP_TYPE_ADMIN type: string x-speakeasy-unknown-values: allow type: - array - 'null' onlyGetExpiring: description: >- If true, restrict results to entitlements that have at least one expiring grant. type: - boolean - 'null' pageSize: description: >- The pageSize where 0 <= pageSize <= 100. Values < 10 will be set to 10. A value of 0 returns the default page size (currently 25) format: int32 type: - integer - 'null' pageToken: description: The pageToken field. type: - string - 'null' policyRefs: description: Search for app entitlements that use any of these policies. items: $ref: '#/components/schemas/c1.api.policy.v1.PolicyRef' type: - array - 'null' query: description: >- Query the app entitlements with a fuzzy search on display name and description. type: - string - 'null' refs: description: Filter results to only these specific entitlements. items: $ref: '#/components/schemas/c1.api.app.v1.AppEntitlementRef' type: - array - 'null' requestSchemaIds: description: >- Search for app entitlements that are bound to any of these request schemas. items: type: string type: - array - 'null' resourceIds: description: Search for app entitlements that belongs to these resources. items: type: string type: - array - 'null' resourceTraitIds: description: >- Filter results to entitlements whose resource types have any of these trait IDs. items: type: string type: - array - 'null' resourceTypeIds: description: >- Search for app entitlements that are for items with resources types that have matching names. Example names are "group", "role", and "app". items: type: string type: - array - 'null' riskLevelIds: description: Search for app entitlements with these risk levels. items: type: string type: - array - 'null' sourceConnectorId: description: Filter results to entitlements synced from this connector. type: - string - 'null' title: App Entitlement Search Service Search Request type: object x-speakeasy-name-override: AppEntitlementSearchServiceSearchRequest c1.api.app.v1.AppEntitlementSearchServiceSearchResponse: description: The AppEntitlementSearchServiceSearchResponse message. properties: expanded: description: List of related objects. items: additionalProperties: true description: >- Contains an arbitrary serialized message along with a @type that describes the type of the serialized message. properties: '@type': description: The type of the serialized message. type: string type: object type: - array - 'null' facets: oneOf: - $ref: '#/components/schemas/c1.api.search.v1.Facets' - type: 'null' list: description: List of app entitlement view objects. items: $ref: '#/components/schemas/c1.api.app.v1.AppEntitlementView' type: - array - 'null' nextPageToken: description: >- The nextPageToken is shown for the next page if the number of results is larger than the max page size. The server returns one page of results and the nextPageToken until all results are retreived. To retrieve the next page, use the same request and append a pageToken field with the value of nextPageToken shown on the previous page. type: - string - 'null' title: App Entitlement Search Service Search Response type: object x-speakeasy-name-override: AppEntitlementSearchServiceSearchResponse c1.api.app.v1.AppEntitlementRef: description: The AppEntitlementRef message. properties: appId: description: The appId field. type: - string - 'null' id: description: The id field. type: - string - 'null' title: App Entitlement Ref type: object x-speakeasy-name-override: AppEntitlementRef c1.api.app.v1.AppEntitlementExpandMask: description: >- The app entitlement expand mask allows the user to get additional information when getting responses containing app entitlement views. properties: paths: description: >- Array of strings to describe which items to expand on the return value. Can be any combination of "*", "app_id", "app_resource_type_id", or "app_resource_id". items: type: string type: - array - 'null' title: App Entitlement Expand Mask type: object x-speakeasy-name-override: AppEntitlementExpandMask c1.api.policy.v1.PolicyRef: description: The PolicyRef message. properties: id: description: The id field. type: - string - 'null' title: Policy Ref type: object x-speakeasy-name-override: PolicyRef c1.api.search.v1.Facets: description: Indicates one value of a facet. properties: count: description: The count of items in this facet. format: int64 type: - string - 'null' facets: description: The facet being referenced. items: $ref: '#/components/schemas/c1.api.search.v1.FacetCategory' type: - array - 'null' title: Facets type: object x-speakeasy-name-override: Facets c1.api.app.v1.AppEntitlementView: description: >- The app entitlement view contains the serialized app entitlement and paths to objects referenced by the app entitlement. properties: appEntitlement: oneOf: - $ref: '#/components/schemas/c1.api.app.v1.AppEntitlement' - type: 'null' appPath: description: >- JSONPATH expression indicating the location of the App object in the array. type: - string - 'null' appResourcePath: description: >- JSONPATH expression indicating the location of the App Resource Type object in the expanded array. type: - string - 'null' appResourceTypePath: description: >- JSONPATH expression indicating the location of the App Resource object in the array. type: - string - 'null' objectPermissions: oneOf: - $ref: '#/components/schemas/c1.api.iam.v1.ActorObjectPermissions' - type: 'null' title: App Entitlement View type: object x-speakeasy-name-override: AppEntitlementView c1.api.search.v1.FacetCategory: description: > The FacetCategory indicates a grouping of facets by type. For example, facets "OnePassword" and "Okta" would group under an "Apps" category. This message contains a oneof named item. Only a single field of the following list may be set at a time: - value - range properties: displayName: description: The display name of the category. type: - string - 'null' iconUrl: description: An icon for the category. type: - string - 'null' param: description: The param that is being set when checking a facet in this category. type: - string - 'null' range: oneOf: - $ref: '#/components/schemas/c1.api.search.v1.FacetRangeItem' - type: 'null' value: oneOf: - $ref: '#/components/schemas/c1.api.search.v1.FacetValueItem' - type: 'null' title: Facet Category type: object x-speakeasy-name-override: FacetCategory c1.api.app.v1.AppEntitlement: description: > The app entitlement represents one permission in a downstream App (SAAS) that can be granted. For example, GitHub Read vs GitHub Write. This message contains a oneof named max_grant_duration. Only a single field of the following list may be set at a time: - durationUnset - durationGrant properties: alias: description: >- The alias of the app entitlement used by Cone. Also exact-match queryable. type: - string - 'null' annotations: additionalProperties: type: string description: |- Bounded key/value metadata bag for IaC marking and customer tags. See .rfcs/object-annotations.md §2. Limits: ≤16 entries; keys 1–128 chars matching ^[A-Za-z][A-Za-z0-9._/-]{0,127}$; values 0–256 chars URL-safe ASCII; total serialized ≤ 4096 bytes. Keys matching ^c1/ are reserved. Well-known keys: `managed_by`, `iac_workspace`, `iac_resource_address`, `iac_tool_version`. type: object x-speakeasy-terraform-plan-modifier: imports: - >- github.com/conductorone/terraform-provider-conductorone/internal/annotations schemaDefinition: annotations.PlanModifier() appId: description: The ID of the app that is associated with the app entitlement. type: - string - 'null' appResourceId: description: >- The ID of the app resource that is associated with the app entitlement type: - string - 'null' appResourceTypeId: description: >- The ID of the app resource type that is associated with the app entitlement type: - string - 'null' certifyPolicyId: description: >- The ID of the policy that will be used for certify tickets related to the app entitlement. type: - string - 'null' complianceFrameworkValueIds: description: >- The IDs of different compliance frameworks associated with this app entitlement ex (SOX, HIPAA, PCI, etc.) items: type: string type: - array - 'null' createdAt: format: date-time readOnly: true type: - string - 'null' defaultValuesApplied: description: >- Flag to indicate if app-level access request defaults have been applied to the entitlement type: - boolean - 'null' deletedAt: format: date-time readOnly: true type: - string - 'null' deprovisionerPolicy: oneOf: - $ref: '#/components/schemas/c1.api.policy.v1.ProvisionPolicy' - type: 'null' description: description: The description of the app entitlement. type: - string - 'null' displayName: description: The display name of the app entitlement. type: - string - 'null' durationGrant: format: duration type: - string - 'null' durationUnset: type: - object - 'null' emergencyGrantEnabled: description: >- This enables tasks to be created in an emergency and use a selected emergency access policy. type: - boolean - 'null' emergencyGrantPolicyId: description: >- The ID of the policy that will be used for emergency access grant tasks. type: - string - 'null' externalId: description: >- The upstream product's native external ID for this entitlement (e.g. an Okta group ID). Populated from the connector's external ID during sync. readOnly: true type: - string - 'null' grantCount: description: The amount of grants open for this entitlement format: int64 readOnly: true type: - string - 'null' grantPolicyId: description: >- The ID of the policy that will be used for grant tickets related to the app entitlement. type: - string - 'null' id: description: The unique ID for the App Entitlement. readOnly: true type: - string - 'null' isAutomationEnabled: description: >- Flag to indicate whether automation (for adding users to entitlement based on rules) has been enabled. readOnly: true type: - boolean - 'null' isManuallyManaged: description: Flag to indicate if the app entitlement is manually managed. type: - boolean - 'null' matchBatonId: description: >- An identifier used to match this entitlement to a connector-synced entitlement during sync. type: - string - 'null' overrideAccessRequestsDefaults: description: >- Flag to indicate if the app-level access request settings have been overridden for the entitlement type: - boolean - 'null' provisionerPolicy: oneOf: - $ref: '#/components/schemas/c1.api.policy.v1.ProvisionPolicy' - type: 'null' purpose: description: >- The purpose of this entitlement (e.g., assignment, permission, ownership). enum: - APP_ENTITLEMENT_PURPOSE_VALUE_UNSPECIFIED - APP_ENTITLEMENT_PURPOSE_VALUE_ASSIGNMENT - APP_ENTITLEMENT_PURPOSE_VALUE_PERMISSION - APP_ENTITLEMENT_PURPOSE_VALUE_OWNERSHIP type: - string - 'null' x-speakeasy-unknown-values: allow requestSchemaId: description: The ID of the request schema associated with this app entitlement. type: - string - 'null' revokePolicyId: description: >- The ID of the policy that will be used for revoke tickets related to the app entitlement type: - string - 'null' riskLevelValueId: description: The ID of the risk level assigned to this entitlement. type: - string - 'null' slug: description: >- The slug is displayed as an oval next to the name in the frontend of C1, it tells you what permission the entitlement grants. See https://www.conductorone.com/docs/product/admin/entitlements/ type: - string - 'null' sourceConnectorIds: additionalProperties: type: string description: Map to tell us which connector the entitlement came from. type: object systemBuiltin: description: This field indicates if this is a system builtin entitlement. readOnly: true type: - boolean - 'null' updatedAt: format: date-time readOnly: true type: - string - 'null' userEditedMask: type: - string - 'null' title: App Entitlement type: object x-speakeasy-entity: Custom App Entitlement x-speakeasy-name-override: AppEntitlement c1.api.iam.v1.ActorObjectPermissions: description: The ActorObjectPermissions message. properties: delete: description: The delete field. type: - boolean - 'null' edit: description: The edit field. type: - boolean - 'null' extra: additionalProperties: type: boolean description: The extra field. type: object read: description: The read field. type: - boolean - 'null' title: Actor Object Permissions type: object x-speakeasy-name-override: ActorObjectPermissions c1.api.search.v1.FacetRangeItem: description: The FacetRangeItem message. properties: ranges: description: An array of facet ranges. items: $ref: '#/components/schemas/c1.api.search.v1.FacetRange' type: - array - 'null' title: Facet Range Item type: object x-speakeasy-name-override: FacetRangeItem c1.api.search.v1.FacetValueItem: description: The FacetValueItem message. properties: values: description: An array of facet values. items: $ref: '#/components/schemas/c1.api.search.v1.FacetValue' type: - array - 'null' title: Facet Value Item type: object x-speakeasy-name-override: FacetValueItem c1.api.policy.v1.ProvisionPolicy: description: > ProvisionPolicy is a oneOf that indicates how a provision step should be processed. This message contains a oneof named typ. Only a single field of the following list may be set at a time: - connector - manual - delegated - webhook - multiStep - externalTicket - unconfigured - action properties: action: oneOf: - $ref: '#/components/schemas/c1.api.policy.v1.ActionProvision' - type: 'null' connector: oneOf: - $ref: '#/components/schemas/c1.api.policy.v1.ConnectorProvision' - type: 'null' delegated: oneOf: - $ref: '#/components/schemas/c1.api.policy.v1.DelegatedProvision' - type: 'null' externalTicket: oneOf: - $ref: '#/components/schemas/c1.api.policy.v1.ExternalTicketProvision' - type: 'null' manual: oneOf: - $ref: '#/components/schemas/c1.api.policy.v1.ManualProvision' - type: 'null' multiStep: oneOf: - $ref: '#/components/schemas/c1.api.policy.v1.MultiStep' - type: 'null' unconfigured: oneOf: - $ref: '#/components/schemas/c1.api.policy.v1.UnconfiguredProvision' - type: 'null' webhook: oneOf: - $ref: '#/components/schemas/c1.api.policy.v1.WebhookProvision' - type: 'null' title: Provision Policy type: object x-speakeasy-name-override: ProvisionPolicy c1.api.search.v1.FacetRange: description: The FacetRange message. properties: count: description: The count of items in the range. format: int64 type: - string - 'null' displayName: description: The display name of the range. type: - string - 'null' from: description: The starting value of the range. format: int64 type: - string - 'null' iconUrl: description: The icon of the range. type: - string - 'null' to: description: The ending value of the range. format: int64 type: - string - 'null' title: Facet Range type: object x-speakeasy-name-override: FacetRange c1.api.search.v1.FacetValue: description: A FacetValue message contains count and value of the facet entry. properties: count: description: The count of the values in this facet. format: int64 type: - string - 'null' displayName: description: The name of this facet. type: - string - 'null' iconUrl: description: The icon for this facet. type: - string - 'null' value: description: The value of this facet. type: - string - 'null' title: Facet Value type: object x-speakeasy-name-override: FacetValue c1.api.policy.v1.ActionProvision: description: >- This provision step indicates that account lifecycle action should be called to provision this entitlement. properties: actionName: description: The actionName field. type: - string - 'null' appId: description: The appId field. type: - string - 'null' connectorId: description: The connectorId field. type: - string - 'null' displayName: description: The displayName field. type: - string - 'null' title: Action Provision type: object x-speakeasy-name-override: ActionProvision c1.api.policy.v1.ConnectorProvision: description: > Indicates that a connector should perform the provisioning. This object has no fields. This message contains a oneof named provision_type. Only a single field of the following list may be set at a time: - defaultBehavior - account - deleteAccount properties: account: oneOf: - $ref: >- #/components/schemas/c1.api.policy.v1.ConnectorProvision.AccountProvision - type: 'null' defaultBehavior: oneOf: - $ref: >- #/components/schemas/c1.api.policy.v1.ConnectorProvision.DefaultBehavior - type: 'null' deleteAccount: oneOf: - $ref: >- #/components/schemas/c1.api.policy.v1.ConnectorProvision.DeleteAccount - type: 'null' title: Connector Provision type: object x-speakeasy-name-override: ConnectorProvision c1.api.policy.v1.DelegatedProvision: description: >- This provision step indicates that we should delegate provisioning to the configuration of another app entitlement. This app entitlement does not have to be one from the same app, but MUST be configured as a proxy binding leading into this entitlement. properties: appId: description: The AppID of the entitlement to delegate provisioning to. type: - string - 'null' entitlementId: description: The ID of the entitlement we are delegating provisioning to. type: - string - 'null' implicit: description: >- If true, a binding will be automatically created from the entitlement of the parent app. type: - boolean - 'null' title: Delegated Provision type: object x-speakeasy-name-override: DelegatedProvision c1.api.policy.v1.ExternalTicketProvision: description: >- This provision step indicates that we should check an external ticket to provision this entitlement properties: appId: description: The appId field. type: - string - 'null' connectorId: description: The connectorId field. type: - string - 'null' externalTicketProvisionerConfigId: description: The externalTicketProvisionerConfigId field. type: - string - 'null' instructions: description: >- This field indicates a text body of instructions for the provisioner to indicate. type: - string - 'null' title: External Ticket Provision type: object x-speakeasy-name-override: ExternalTicketProvision c1.api.policy.v1.ManualProvision: description: >- Manual provisioning indicates that a human must intervene for the provisioning of this step. properties: assignee: oneOf: - $ref: '#/components/schemas/c1.api.policy.v1.ProvisionerAssignment' - type: 'null' instructions: description: >- This field indicates a text body of instructions for the provisioner to indicate. type: - string - 'null' userIds: description: |- An array of users that are required to provision during this step. Deprecated: Use assignee field instead for dynamic provisioner assignment. items: type: string type: - array - 'null' title: Manual Provision type: object x-speakeasy-name-override: ManualProvision c1.api.policy.v1.MultiStep: description: >- MultiStep indicates that this provision step has multiple steps to process. properties: provisionSteps: description: The array of provision steps to process. items: $ref: '#/components/schemas/c1.api.policy.v1.ProvisionPolicy' type: - array - 'null' title: Multi Step type: object x-speakeasy-name-override: MultiStep c1.api.policy.v1.UnconfiguredProvision: description: The UnconfiguredProvision message. title: Unconfigured Provision type: object x-speakeasy-name-override: UnconfiguredProvision c1.api.policy.v1.WebhookProvision: description: >- This provision step indicates that a webhook should be called to provision this entitlement. properties: webhookId: description: The ID of the webhook to call for provisioning. type: - string - 'null' title: Webhook Provision type: object x-speakeasy-name-override: WebhookProvision c1.api.policy.v1.ConnectorProvision.AccountProvision: description: > The AccountProvision message. This message contains a oneof named storage_type. Only a single field of the following list may be set at a time: - saveToVault - doNotSave properties: config: additionalProperties: true type: - object - 'null' connectorId: description: The connectorId field. type: - string - 'null' doNotSave: oneOf: - $ref: >- #/components/schemas/c1.api.policy.v1.ConnectorProvision.DoNotSave - type: 'null' saveToVault: oneOf: - $ref: >- #/components/schemas/c1.api.policy.v1.ConnectorProvision.SaveToVault - type: 'null' schemaId: description: The schemaId field. type: - string - 'null' title: Account Provision type: object x-speakeasy-name-override: AccountProvision c1.api.policy.v1.ConnectorProvision.DefaultBehavior: description: The DefaultBehavior message. properties: connectorId: description: >- this checks if the entitlement is enabled by provisioning in a specific connector this can happen automatically and doesn't need any extra info type: - string - 'null' title: Default Behavior type: object x-speakeasy-name-override: DefaultBehavior c1.api.policy.v1.ConnectorProvision.DeleteAccount: description: The DeleteAccount message. properties: connectorId: description: The connectorId field. type: - string - 'null' title: Delete Account type: object x-speakeasy-name-override: DeleteAccount c1.api.policy.v1.ProvisionerAssignment: description: > ProvisionerAssignment defines how a provisioner is dynamically assigned. This message contains a oneof named typ. Only a single field of the following list may be set at a time: - users - appOwners - group - manager - expression - entitlementOwners properties: appOwners: oneOf: - $ref: '#/components/schemas/c1.api.policy.v1.AppOwnerProvisioner' - type: 'null' entitlementOwners: oneOf: - $ref: >- #/components/schemas/c1.api.policy.v1.EntitlementOwnerProvisioner - type: 'null' expression: oneOf: - $ref: '#/components/schemas/c1.api.policy.v1.ExpressionProvisioner' - type: 'null' group: oneOf: - $ref: '#/components/schemas/c1.api.policy.v1.GroupProvisioner' - type: 'null' manager: oneOf: - $ref: '#/components/schemas/c1.api.policy.v1.ManagerProvisioner' - type: 'null' users: oneOf: - $ref: '#/components/schemas/c1.api.policy.v1.UserProvisioner' - type: 'null' title: Provisioner Assignment type: object x-speakeasy-name-override: ProvisionerAssignment c1.api.policy.v1.ConnectorProvision.DoNotSave: description: The DoNotSave message. title: Do Not Save type: object x-speakeasy-name-override: DoNotSave c1.api.policy.v1.ConnectorProvision.SaveToVault: description: The SaveToVault message. properties: vaultIds: description: The vaultIds field. items: type: string type: - array - 'null' title: Save To Vault type: object x-speakeasy-name-override: SaveToVault c1.api.policy.v1.AppOwnerProvisioner: description: AppOwnerProvisioner resolves to app owners. properties: allowReassignment: description: Whether the provisioner can reassign the task. type: - boolean - 'null' fallbackUserIds: description: Fallback user IDs if no app owners are found. items: type: string type: - array - 'null' title: App Owner Provisioner type: object x-speakeasy-name-override: AppOwnerProvisioner c1.api.policy.v1.EntitlementOwnerProvisioner: description: EntitlementOwnerProvisioner resolves to entitlement owners. properties: allowReassignment: description: Whether the provisioner can reassign the task. type: - boolean - 'null' fallbackUserIds: description: Fallback user IDs if no entitlement owners are found. items: type: string type: - array - 'null' title: Entitlement Owner Provisioner type: object x-speakeasy-name-override: EntitlementOwnerProvisioner c1.api.policy.v1.ExpressionProvisioner: description: >- ExpressionProvisioner evaluates CEL expressions to determine provisioners. properties: allowReassignment: description: Whether the provisioner can reassign the task. type: - boolean - 'null' expressions: description: The CEL expressions to evaluate. items: type: string type: - array - 'null' fallbackUserIds: description: Fallback user IDs if expression evaluation yields no users. items: type: string type: - array - 'null' title: Expression Provisioner type: object x-speakeasy-name-override: ExpressionProvisioner c1.api.policy.v1.GroupProvisioner: description: GroupProvisioner resolves to members of a specific group. properties: allowReassignment: description: Whether the provisioner can reassign the task. type: - boolean - 'null' appGroupId: description: The app group ID (entitlement ID). type: - string - 'null' appId: description: The app ID containing the group. type: - string - 'null' fallbackUserIds: description: Fallback user IDs if no group members are found. items: type: string type: - array - 'null' title: Group Provisioner type: object x-speakeasy-name-override: GroupProvisioner c1.api.policy.v1.ManagerProvisioner: description: ManagerProvisioner resolves to the user's manager. properties: allowReassignment: description: Whether the provisioner can reassign the task. type: - boolean - 'null' fallbackUserIds: description: Fallback user IDs if no manager is found. items: type: string type: - array - 'null' title: Manager Provisioner type: object x-speakeasy-name-override: ManagerProvisioner c1.api.policy.v1.UserProvisioner: description: UserProvisioner assigns specific users as provisioners. properties: allowReassignment: description: Whether the provisioner can reassign the task. type: - boolean - 'null' userIds: description: The user IDs to assign as provisioners. items: type: string type: - array - 'null' title: User Provisioner type: object x-speakeasy-name-override: UserProvisioner securitySchemes: bearerAuth: scheme: bearer type: http oauth: description: >- This API uses OAuth2 with the Client Credential flow. Client Credentials must be sent in the BODY, not the headers. For an example of how to implement this, refer to the [c1TokenSource.Token()](https://github.com/ConductorOne/conductorone-sdk-go/blob/3375fe7c0126d17e7ec4e711693dee7b791023aa/token_source.go#L101-L187) function. flows: clientCredentials: scopes: {} tokenUrl: /auth/v1/token type: oauth2 ````