---
title: "List"
method: GET
path: "/api/v1/apps/{app_id}/authzen_servers"
tags: ["AuthZEN Servers"]
---

# List

`GET /api/v1/apps/{app_id}/authzen_servers`

## Request

- Base URL: `https://example.conductor.one`
- URL: `https://example.conductor.one/api/v1/apps/{app_id}/authzen_servers`
- Auth: HTTP bearer and OAuth 2
  - Client credentials
  - Token URL: `/auth/v1/token`

List retrieves AuthZEN servers for an app.

## Path parameters

- `app_id` string, required: App identifier.

## Query parameters

- `page_size` integer: Page size (max 100).
- `page_token` string: Page token for pagination.

## Response `200`

AuthzenServerServiceListResponse lists AuthZEN servers for an app.

- C1ApiAuthzenV1AuthzenServerServiceListResponse: AuthzenServerServiceListResponse lists AuthZEN servers for an app.
  - `list` C1ApiAuthzenV1AuthzenServer[], nullable: The list field.
    - `activePolicyId` string: The active immutable policy revision. Empty is default deny.
    - `appId` string: App identifier.
    - `createdAt` string, date-time, nullable
    - `displayName` string: The displayName field.
    - `evaluateEntitlementId` string: The minted "evaluate" entitlement (derived from the server id; returned for linking) -- grant it to a caller to let it POST the access evaluation endpoint.
    - `id` string: The id field.
    - `mode` 'AUTHZEN_MODE_UNSPECIFIED' | 'AUTHZEN_MODE_DISABLED' | 'AUTHZEN_MODE_OBSERVE' | 'AUTHZEN_MODE_ENFORCE': The e-stop, now a tri-state. DISABLED (and UNSPECIFIED) denies every call without touching the entitlement stack or its grants; OBSERVE evaluates fully but answers allow, recording what ENFORCE would have said; ENFORCE answers the policy's decision.
    - `searchEntitlementId` string: The minted "search" entitlement (derived from the server id; returned for linking) -- grant it to a caller to let it POST the subject/resource/action search endpoints.
    - `tokenAudience` string: The `audience` to send when exchanging a token for access to this server. Every AuthZEN deployment in the tenant shares it, so it names the service; `token_resource` names this server.
    - `tokenResource` string: The `resource` to send alongside `token_audience`. It pins the exchange to this server, and the issued grant echoes it back, so send it exactly as given.
    - `tokenScopes` string[], nullable: The scopes this server can issue. An exchange receives the ones it requests that the caller also holds the matching capability entitlement for.
    - `updatedAt` string, date-time, nullable
  - `nextPageToken` string: Token for next page.

## Changes

- **2026-10-06** `918a4e749f56`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/conductorone/apis/c1-api/changes/api/v1/apps/:app_id/authzen_servers/get.md)

---

[API](https://skmtc.dev/conductorone/apis/c1-api.md) - [All operations](https://skmtc.dev/conductorone/apis/c1-api/llms.txt) - [OpenAPI document](https://skmtc.dev/conductorone/apis/c1-api/revisions/fe943bedf41b?raw)