> ## Documentation Index > Fetch the complete documentation index at: https://conductorone-docs-mcp-bridge-private-server.mintlify.site/llms.txt > Use this file to discover all available pages before exploring further. # Search > Search findings using full-text query and filters for severity, state, type, and app. ## OpenAPI ````yaml https://spec.speakeasy.com/conductor-one/conductorone/my-source-with-code-samples post /api/v1/findings/search openapi: 3.1.0 info: description: The C1 API is a HTTP API for managing C1 resources. title: C1 API version: 0.1.0-alpha servers: - description: The C1 API server for the current tenant. url: https://{tenantDomain}.conductor.one variables: tenantDomain: default: example description: The domain of the tenant to use for this request. security: - bearerAuth: [] oauth: [] paths: /api/v1/findings/search: post: tags: - Findings summary: Search description: >- Search findings using full-text query and filters for severity, state, type, and app. operationId: c1.api.finding.v1.FindingSearchService.Search requestBody: content: application/json: schema: $ref: '#/components/schemas/c1.api.finding.v1.FindingSearchRequest' responses: '200': content: application/json: schema: $ref: '#/components/schemas/c1.api.finding.v1.FindingSearchResponse' description: Successful response x-codeSamples: - lang: go label: Search source: "package main\n\nimport(\n\t\"context\"\n\t\"github.com/conductorone/conductorone-sdk-go/pkg/models/shared\"\n\tconductoronesdkgo \"github.com/conductorone/conductorone-sdk-go\"\n\t\"log\"\n)\n\nfunc main() {\n ctx := context.Background()\n\n s := conductoronesdkgo.New(\n conductoronesdkgo.WithSecurity(shared.Security{\n BearerAuth: \"\",\n Oauth: \"\",\n }),\n )\n\n res, err := s.FindingSearch.Search(ctx, nil)\n if err != nil {\n log.Fatal(err)\n }\n if res.FindingSearchResponse != nil {\n // handle response\n }\n}" - lang: typescript label: Typescript (SDK) source: >- import { ConductoroneSDKTypescript } from "conductorone-sdk-typescript"; const conductoroneSDKTypescript = new ConductoroneSDKTypescript({ security: { bearerAuth: "", oauth: "", }, }); async function run() { const result = await conductoroneSDKTypescript.findingSearch.search(); console.log(result); } run(); components: schemas: c1.api.finding.v1.FindingSearchRequest: description: The FindingSearchRequest message. properties: appIds: description: Filter by app IDs (OR within field). items: type: string type: - array - 'null' appUserIds: description: |- Filter by app user IDs (OR within field). Matches findings whose target.app_user_target.app_user_id is in this list. items: type: string type: - array - 'null' decoyIds: description: |- Filter by decoy IDs (OR within field). Matches findings whose target.decoy_target.decoy_id is in this list. items: type: string type: - array - 'null' findingTypes: description: Filter by finding type (OR within field). items: enum: - FINDING_TYPE_UNSPECIFIED - FINDING_TYPE_SIMILAR_USERNAME_MATCH - FINDING_TYPE_SERVICE_ACCOUNT_MISCLASSIFICATION - FINDING_TYPE_DECOY_CREDENTIAL_USED type: string x-speakeasy-unknown-values: allow type: - array - 'null' pageSize: description: Maximum number of findings to return per page. format: int32 type: - integer - 'null' pageToken: description: Pagination token from a previous response. type: - string - 'null' query: description: Free text search query. type: - string - 'null' severities: description: Filter by severities (OR within field). items: enum: - FINDING_SEVERITY_UNSPECIFIED - FINDING_SEVERITY_INFO - FINDING_SEVERITY_LOW - FINDING_SEVERITY_MEDIUM - FINDING_SEVERITY_HIGH - FINDING_SEVERITY_CRITICAL type: string x-speakeasy-unknown-values: allow type: - array - 'null' states: description: Filter by states (OR within field). items: enum: - FINDING_STATE_UNSPECIFIED - FINDING_STATE_OPEN - FINDING_STATE_IN_PROGRESS - FINDING_STATE_RESOLVED - FINDING_STATE_SNOOZED - FINDING_STATE_RISK_ACCEPTED - FINDING_STATE_SUPPRESSED type: string x-speakeasy-unknown-values: allow type: - array - 'null' title: Finding Search Request type: object x-speakeasy-name-override: FindingSearchRequest c1.api.finding.v1.FindingSearchResponse: description: The FindingSearchResponse message. properties: list: description: The list field. items: $ref: '#/components/schemas/c1.api.finding.v1.Finding' type: - array - 'null' nextPageToken: description: The nextPageToken field. type: - string - 'null' title: Finding Search Response type: object x-speakeasy-name-override: FindingSearchResponse c1.api.finding.v1.Finding: description: > The Finding message. This message contains a oneof named finding_type. Only a single field of the following list may be set at a time: - similarUsernameMatch - serviceAccountMisclassification - decoyCredentialUsed This message contains a oneof named target. Only a single field of the following list may be set at a time: - identityUserTarget - appUserTarget - decoyTarget This message contains a oneof named evidence. Only a single field of the following list may be set at a time: - similarUsernameMatchEvidence - serviceAccountMisclassificationEvidence properties: appId: description: The appId field. type: - string - 'null' appUserTarget: oneOf: - $ref: '#/components/schemas/c1.api.finding.v1.AppUserTarget' - type: 'null' assignedOwner: oneOf: - $ref: '#/components/schemas/c1.api.finding.v1.FindingOwnerRef' - type: 'null' computedOwner: oneOf: - $ref: '#/components/schemas/c1.api.finding.v1.FindingOwnerRef' - type: 'null' createdAt: format: date-time type: - string - 'null' customTags: additionalProperties: type: string description: The customTags field. type: object decoyCredentialUsed: oneOf: - $ref: '#/components/schemas/c1.api.finding.v1.DecoyCredentialUsedType' - type: 'null' decoyTarget: oneOf: - $ref: '#/components/schemas/c1.api.finding.v1.DecoyTarget' - type: 'null' fingerprint: description: The fingerprint field. type: - string - 'null' firstObservedAt: format: date-time type: - string - 'null' id: description: The id field. type: - string - 'null' identityUserTarget: oneOf: - $ref: '#/components/schemas/c1.api.finding.v1.IdentityUserTarget' - type: 'null' lastObservedAt: format: date-time type: - string - 'null' recurrenceCount: description: The recurrenceCount field. format: uint32 type: - integer - 'null' remediationDescription: description: The remediationDescription field. type: - string - 'null' resolvedAt: format: date-time type: - string - 'null' riskAcceptanceExpiresAt: format: date-time type: - string - 'null' riskAcceptanceJustification: description: The riskAcceptanceJustification field. type: - string - 'null' riskScore: oneOf: - $ref: '#/components/schemas/c1.api.finding.v1.FindingRiskScore' - type: 'null' serviceAccountMisclassification: oneOf: - $ref: >- #/components/schemas/c1.api.finding.v1.ServiceAccountMisclassificationType - type: 'null' serviceAccountMisclassificationEvidence: oneOf: - $ref: >- #/components/schemas/c1.api.finding.v1.ServiceAccountMisclassificationEvidence - type: 'null' severity: description: The severity field. enum: - FINDING_SEVERITY_UNSPECIFIED - FINDING_SEVERITY_INFO - FINDING_SEVERITY_LOW - FINDING_SEVERITY_MEDIUM - FINDING_SEVERITY_HIGH - FINDING_SEVERITY_CRITICAL type: - string - 'null' x-speakeasy-unknown-values: allow similarUsernameMatch: oneOf: - $ref: '#/components/schemas/c1.api.finding.v1.SimilarUsernameMatchType' - type: 'null' similarUsernameMatchEvidence: oneOf: - $ref: >- #/components/schemas/c1.api.finding.v1.SimilarUsernameMatchEvidence - type: 'null' snoozeReason: description: The snoozeReason field. type: - string - 'null' snoozeUntil: format: date-time type: - string - 'null' sourceDetectorId: description: The sourceDetectorId field. type: - string - 'null' state: description: The state field. enum: - FINDING_STATE_UNSPECIFIED - FINDING_STATE_OPEN - FINDING_STATE_IN_PROGRESS - FINDING_STATE_RESOLVED - FINDING_STATE_SNOOZED - FINDING_STATE_RISK_ACCEPTED - FINDING_STATE_SUPPRESSED type: - string - 'null' x-speakeasy-unknown-values: allow stateUpdatedById: description: The stateUpdatedById field. type: - string - 'null' suppressReason: description: The suppressReason field. type: - string - 'null' taskId: description: The taskId field. type: - string - 'null' updatedAt: format: date-time type: - string - 'null' title: Finding type: object x-speakeasy-name-override: Finding c1.api.finding.v1.AppUserTarget: description: The AppUserTarget message. properties: appId: description: The appId field. type: - string - 'null' appUserId: description: The appUserId field. type: - string - 'null' title: App User Target type: object x-speakeasy-name-override: AppUserTarget c1.api.finding.v1.FindingOwnerRef: description: > The FindingOwnerRef message. This message contains a oneof named owner. Only a single field of the following list may be set at a time: - identityUserId - appOwnerAppId - managerOfUserId - userSetId properties: appOwnerAppId: description: >- The appOwnerAppId field. This field is part of the `owner` oneof. See the documentation for `c1.api.finding.v1.FindingOwnerRef` for more details. type: - string - 'null' identityUserId: description: >- The identityUserId field. This field is part of the `owner` oneof. See the documentation for `c1.api.finding.v1.FindingOwnerRef` for more details. type: - string - 'null' managerOfUserId: description: >- The managerOfUserId field. This field is part of the `owner` oneof. See the documentation for `c1.api.finding.v1.FindingOwnerRef` for more details. type: - string - 'null' userSetId: description: >- The userSetId field. This field is part of the `owner` oneof. See the documentation for `c1.api.finding.v1.FindingOwnerRef` for more details. type: - string - 'null' title: Finding Owner Ref type: object x-speakeasy-name-override: FindingOwnerRef c1.api.finding.v1.DecoyCredentialUsedType: description: |- DecoyCredentialUsedType: a planted decoy credential authenticated successfully. properties: decoyId: description: The decoyId field. type: - string - 'null' kind: description: The kind field. enum: - DECOY_CREDENTIAL_KIND_UNSPECIFIED - DECOY_CREDENTIAL_KIND_USER_CLIENT_CREDENTIAL - DECOY_CREDENTIAL_KIND_CONNECTOR_CLIENT - DECOY_CREDENTIAL_KIND_WORKLOAD_FEDERATION - DECOY_CREDENTIAL_KIND_ACCESS_TOKEN type: - string - 'null' x-speakeasy-unknown-values: allow title: Decoy Credential Used Type type: object x-speakeasy-name-override: DecoyCredentialUsedType c1.api.finding.v1.DecoyTarget: description: |- DecoyTarget points at the planted decoy that produced this finding. Populated for findings whose subject is the decoy artifact itself (e.g. decoy_credential_used), giving the UI and routing rules a uniform handle to the decoy alongside the finding_type payload. properties: decoyId: description: The decoyId field. type: - string - 'null' title: Decoy Target type: object x-speakeasy-name-override: DecoyTarget c1.api.finding.v1.IdentityUserTarget: description: The IdentityUserTarget message. properties: identityUserId: description: The identityUserId field. type: - string - 'null' title: Identity User Target type: object x-speakeasy-name-override: IdentityUserTarget c1.api.finding.v1.FindingRiskScore: description: The FindingRiskScore message. properties: originalScore: description: The originalScore field. format: uint32 type: - integer - 'null' overrideByUserId: description: The overrideByUserId field. type: - string - 'null' overrideScore: description: The overrideScore field. format: uint32 type: - integer - 'null' riskFactors: description: The riskFactors field. items: $ref: '#/components/schemas/c1.api.finding.v1.FindingRiskFactor' type: - array - 'null' score: description: The score field. format: uint32 type: - integer - 'null' systemScore: description: The systemScore field. format: uint32 type: - integer - 'null' title: Finding Risk Score type: object x-speakeasy-name-override: FindingRiskScore c1.api.finding.v1.ServiceAccountMisclassificationType: description: The ServiceAccountMisclassificationType message. properties: currentAccountType: description: The currentAccountType field. enum: - APP_USER_TYPE_UNSPECIFIED - APP_USER_TYPE_USER - APP_USER_TYPE_SERVICE_ACCOUNT - APP_USER_TYPE_SYSTEM_ACCOUNT type: - string - 'null' x-speakeasy-unknown-values: allow detectedAccountType: description: The detectedAccountType field. enum: - APP_USER_TYPE_UNSPECIFIED - APP_USER_TYPE_USER - APP_USER_TYPE_SERVICE_ACCOUNT - APP_USER_TYPE_SYSTEM_ACCOUNT type: - string - 'null' x-speakeasy-unknown-values: allow title: Service Account Misclassification Type type: object x-speakeasy-name-override: ServiceAccountMisclassificationType c1.api.finding.v1.ServiceAccountMisclassificationEvidence: description: The ServiceAccountMisclassificationEvidence message. properties: detectionReason: description: The detectionReason field. type: - string - 'null' title: Service Account Misclassification Evidence type: object x-speakeasy-name-override: ServiceAccountMisclassificationEvidence c1.api.finding.v1.SimilarUsernameMatchType: description: The SimilarUsernameMatchType message. properties: proposedIdentityUserId: description: The proposedIdentityUserId field. type: - string - 'null' title: Similar Username Match Type type: object x-speakeasy-name-override: SimilarUsernameMatchType c1.api.finding.v1.SimilarUsernameMatchEvidence: description: The SimilarUsernameMatchEvidence message. properties: appUsername: description: The appUsername field. type: - string - 'null' identityUsername: description: The identityUsername field. type: - string - 'null' similarityScore: description: The similarityScore field. type: - number - 'null' title: Similar Username Match Evidence type: object x-speakeasy-name-override: SimilarUsernameMatchEvidence c1.api.finding.v1.FindingRiskFactor: description: The FindingRiskFactor message. properties: description: description: The description field. type: - string - 'null' name: description: The name field. type: - string - 'null' severity: description: The severity field. enum: - FINDING_SEVERITY_UNSPECIFIED - FINDING_SEVERITY_INFO - FINDING_SEVERITY_LOW - FINDING_SEVERITY_MEDIUM - FINDING_SEVERITY_HIGH - FINDING_SEVERITY_CRITICAL type: - string - 'null' x-speakeasy-unknown-values: allow weight: description: The weight field. format: uint32 type: - integer - 'null' title: Finding Risk Factor type: object x-speakeasy-name-override: FindingRiskFactor securitySchemes: bearerAuth: scheme: bearer type: http oauth: description: >- This API uses OAuth2 with the Client Credential flow. Client Credentials must be sent in the BODY, not the headers. For an example of how to implement this, refer to the [c1TokenSource.Token()](https://github.com/ConductorOne/conductorone-sdk-go/blob/3375fe7c0126d17e7ec4e711693dee7b791023aa/token_source.go#L101-L187) function. flows: clientCredentials: scopes: {} tokenUrl: /auth/v1/token type: oauth2 ````