---
title: "Get"
method: GET
path: "/api/v1/apps/{app_id}/authzen_servers/{id}"
tags: ["AuthZEN Servers"]
---

# Get

`GET /api/v1/apps/{app_id}/authzen_servers/{id}`

## Request

- Base URL: `https://example.conductor.one`
- URL: `https://example.conductor.one/api/v1/apps/{app_id}/authzen_servers/{id}`
- Auth: HTTP bearer and OAuth 2
  - Client credentials
  - Token URL: `/auth/v1/token`

Get retrieves one AuthZEN server.

## Path parameters

- `app_id` string, required: App identifier.
- `id` string, required: Server identifier.

## Response `200`

AuthzenServerServiceGetResponse returns the requested AuthZEN server.

- C1ApiAuthzenV1AuthzenServerServiceGetResponse: AuthzenServerServiceGetResponse returns the requested AuthZEN server.
  - `authzenServer` C1ApiAuthzenV1AuthzenServer: AuthzenServer is the customer-facing AuthZEN PDP endpoint for one App.
    - `activePolicyId` string: The active immutable policy revision. Empty is default deny.
    - `appId` string: App identifier.
    - `createdAt` string, date-time, nullable
    - `displayName` string: The displayName field.
    - `evaluateEntitlementId` string: The minted "evaluate" entitlement (derived from the server id; returned for linking) -- grant it to a caller to let it POST the access evaluation endpoint.
    - `id` string: The id field.
    - `mode` 'AUTHZEN_MODE_UNSPECIFIED' | 'AUTHZEN_MODE_DISABLED' | 'AUTHZEN_MODE_OBSERVE' | 'AUTHZEN_MODE_ENFORCE': The e-stop, now a tri-state. DISABLED (and UNSPECIFIED) denies every call without touching the entitlement stack or its grants; OBSERVE evaluates fully but answers allow, recording what ENFORCE would have said; ENFORCE answers the policy's decision.
    - `searchEntitlementId` string: The minted "search" entitlement (derived from the server id; returned for linking) -- grant it to a caller to let it POST the subject/resource/action search endpoints.
    - `tokenAudience` string: The `audience` to send when exchanging a token for access to this server. Every AuthZEN deployment in the tenant shares it, so it names the service; `token_resource` names this server.
    - `tokenResource` string: The `resource` to send alongside `token_audience`. It pins the exchange to this server, and the issued grant echoes it back, so send it exactly as given.
    - `tokenScopes` string[], nullable: The scopes this server can issue. An exchange receives the ones it requests that the caller also holds the matching capability entitlement for.
    - `updatedAt` string, date-time, nullable

## Changes

- **2026-10-06** `918a4e749f56`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/conductorone/apis/c1-api/changes/api/v1/apps/:app_id/authzen_servers/:id/get.md)

---

[API](https://skmtc.dev/conductorone/apis/c1-api.md) - [All operations](https://skmtc.dev/conductorone/apis/c1-api/llms.txt) - [OpenAPI document](https://skmtc.dev/conductorone/apis/c1-api/revisions/fe943bedf41b?raw)