---
title: "Update Finding Assignee"
method: POST
path: "/api/v1/findings/{finding_id}/assignee"
tags: ["Findings"]
---

# Update Finding Assignee

`POST /api/v1/findings/{finding_id}/assignee`

## Request

- Base URL: `https://example.conductor.one`
- URL: `https://example.conductor.one/api/v1/findings/{finding_id}/assignee`
- Auth: HTTP bearer and OAuth 2
  - Client credentials
  - Token URL: `/auth/v1/token`

Assign or clear a finding's assignee.

## Path parameters

- `finding_id` string, required: The ID of the finding to assign.

## Request body

- C1ApiFindingV1UpdateFindingAssigneeRequestInput: The UpdateFindingAssigneeRequest message.
  - `assigneeIdentityUserId` string: The identity user to assign. Empty clears the assignment.

## Response `200`

Successful response

- C1ApiFindingV1UpdateFindingAssigneeResponse: The UpdateFindingAssigneeResponse message.
  - `finding` C1ApiFindingV1Finding: The Finding message. This message contains a oneof named finding_type. Only a single field of the following list may be set at a time: - similarUsernameMatch - serviceAccountMisclassification - nhiUnowned - serviceAccountUnowned - decoyCredentialUsed - custom - connectorAnomalyDetectionDisabled - deactivatedOwner - unusedSecret - credentialPubliclyExposed - decoyPubliclyExposed - credentialExpiring - connectorSyncFailing - shadowMcp - shadowApp - mcpGatewayToolCallRisk - edgeFinding This message contains a oneof named target. Only a single field of the following list may be set at a time: - identityUserTarget - appUserTarget - decoyTarget - appResourceTarget - tenantTarget - connectorTarget - usageResourceTarget This message contains a oneof named evidence. Only a single field of the following list may be set at a time: - similarUsernameMatchEvidence - serviceAccountMisclassificationEvidence - nhiUnownedEvidence - deactivatedOwnerEvidence - unusedSecretEvidence - credentialPubliclyExposedEvidence - decoyPubliclyExposedEvidence - credentialExpiringEvidence - connectorSyncFailingEvidence - shadowMcpEvidence - mcpGatewayToolCallRiskEvidence - edgeFindingEvidence
    - `annotations` object: Bounded key/value metadata bag. Limits: ≤16 entries; keys 1-128 chars matching ^[A-Za-z][A-Za-z0-9._/-]{0,127}$; values 0-256 chars; total serialized ≤4096 bytes. Keys matching ^c1/ are reserved. Also readable (and settable) via CEL as both finding.annotations and finding.custom_tags.
    - `appId` string: The appId field.
    - `appResourceTarget` C1ApiFindingV1AppResourceTarget: AppResourceTarget points at the app resource the finding is about.
      - `appId` string: The appId field.
      - `appResourceId` string: The appResourceId field.
      - `appResourceTypeId` string: The appResourceTypeId field.
    - `appUserTarget` C1ApiFindingV1AppUserTarget: The AppUserTarget message.
      - `appId` string: The appId field.
      - `appUserId` string: The appUserId field.
    - `assignedOwner` C1ApiFindingV1FindingOwnerRef: The FindingOwnerRef message. This message contains a oneof named owner. Only a single field of the following list may be set at a time: - identityUserId - appOwnerAppId - managerOfUserId - userSetId
      - `appOwnerAppId` string, nullable: The appOwnerAppId field. This field is part of the `owner` oneof. See the documentation for `c1.api.finding.v1.FindingOwnerRef` for more details.
      - `identityUserId` string, nullable: The identityUserId field. This field is part of the `owner` oneof. See the documentation for `c1.api.finding.v1.FindingOwnerRef` for more details.
      - `managerOfUserId` string, nullable: The managerOfUserId field. This field is part of the `owner` oneof. See the documentation for `c1.api.finding.v1.FindingOwnerRef` for more details.
      - `userSetId` string, nullable: The userSetId field. This field is part of the `owner` oneof. See the documentation for `c1.api.finding.v1.FindingOwnerRef` for more details.
    - `assigneeIdentityUserId` string: Identity user this finding is assigned to. Empty when unassigned.
    - `computedOwner` C1ApiFindingV1FindingOwnerRef: The FindingOwnerRef message. This message contains a oneof named owner. Only a single field of the following list may be set at a time: - identityUserId - appOwnerAppId - managerOfUserId - userSetId
      - `appOwnerAppId` string, nullable: The appOwnerAppId field. This field is part of the `owner` oneof. See the documentation for `c1.api.finding.v1.FindingOwnerRef` for more details.
      - `identityUserId` string, nullable: The identityUserId field. This field is part of the `owner` oneof. See the documentation for `c1.api.finding.v1.FindingOwnerRef` for more details.
      - `managerOfUserId` string, nullable: The managerOfUserId field. This field is part of the `owner` oneof. See the documentation for `c1.api.finding.v1.FindingOwnerRef` for more details.
      - `userSetId` string, nullable: The userSetId field. This field is part of the `owner` oneof. See the documentation for `c1.api.finding.v1.FindingOwnerRef` for more details.
    - `connectorAnomalyDetectionDisabled` C1ApiFindingV1ConnectorAnomalyDetectionDisabledType: ConnectorAnomalyDetectionDisabledType: a connector has sync anomaly detection turned off, so a sudden drop in synced data will not trip the circuit breaker. Target: ConnectorTarget.
    - `connectorSyncFailing` C1ApiFindingV1ConnectorSyncFailingType: ConnectorSyncFailingType: a connector's completed sync runs have ended in error for at least two consecutive runs, with no intervening success. Target: ConnectorTarget.
    - `connectorSyncFailingEvidence` C1ApiFindingV1ConnectorSyncFailingEvidence: ConnectorSyncFailingEvidence describes the failure streak behind a CONNECTOR_SYNC_FAILING finding, refreshed on every re-observation.
      - `consecutiveFailureCount` integer: The consecutiveFailureCount field.
      - `lastFailedAt` string, date-time, nullable
      - `lastSyncLifecycleId` string: Id of the newest failing sync run, not a copy of its error text -- see the c1models message for why the error itself is deliberately not carried here.
      - `streakStartedAt` string, date-time, nullable
    - `connectorTarget` C1ApiFindingV1ConnectorTarget: ConnectorTarget points at the connector that produced this finding.
      - `appId` string: The appId field.
      - `connectorId` string: The connectorId field.
    - `createdAt` string, date-time, nullable
    - `credentialExpiring` C1ApiFindingV1CredentialExpiringType: CredentialExpiringType: a credential is inside the detector's expiry warning window, or already past it. Covers both ConductorOne-managed credentials and connector-synced secret-trait AppResources. Dedup is (credential arm, credential_id/target triple). Target: IdentityUserTarget for a service-principal credential, or AppResourceTarget for a connector-synced secret. This message contains a oneof named credential. Only a single field of the following list may be set at a time: - userClientId - appResourceSecret
      - `appResourceSecret` C1ApiFindingV1AppResourceTarget: AppResourceTarget points at the app resource the finding is about.
        - `appId` string: The appId field.
        - `appResourceId` string: The appResourceId field.
        - `appResourceTypeId` string: The appResourceTypeId field.
      - `credentialDisplayName` string: The credentialDisplayName field.
      - `userClientId` string, nullable: Service-principal credential. This field is part of the `credential` oneof. See the documentation for `c1.api.finding.v1.CredentialExpiringType` for more details.
    - `credentialExpiringEvidence` C1ApiFindingV1CredentialExpiringEvidence: The CredentialExpiringEvidence message.
      - `expired` boolean: Whether the expiry was already past when last observed.
      - `expiresAt` string, date-time, nullable
    - `credentialPubliclyExposed` C1ApiFindingV1CredentialPubliclyExposedType: CredentialPubliclyExposedType: a live credential was reported as publicly exposed. Dedup is (credential arm, credential_id). This message contains a oneof named credential. Only a single field of the following list may be set at a time: - userClientId - connectorClientId - connectorManagedCredentialId - functionClientId
      - `connectorClientId` string, nullable: The connectorClientId field. This field is part of the `credential` oneof. See the documentation for `c1.api.finding.v1.CredentialPubliclyExposedType` for more details.
      - `connectorManagedCredentialId` string, nullable: The connectorManagedCredentialId field. This field is part of the `credential` oneof. See the documentation for `c1.api.finding.v1.CredentialPubliclyExposedType` for more details.
      - `credentialDisplayName` string: The credentialDisplayName field.
      - `functionClientId` string, nullable: The functionClientId field. This field is part of the `credential` oneof. See the documentation for `c1.api.finding.v1.CredentialPubliclyExposedType` for more details.
      - `userClientId` string, nullable: The userClientId field. This field is part of the `credential` oneof. See the documentation for `c1.api.finding.v1.CredentialPubliclyExposedType` for more details.
    - `credentialPubliclyExposedEvidence` C1ApiFindingV1CredentialPubliclyExposedEvidence: CredentialPubliclyExposedEvidence carries scanner attribution for a public exposure.
      - `credentialRevoked` boolean: The credentialRevoked field.
      - `fingerprintPrefix` string: The fingerprintPrefix field.
      - `firstObservedAt` string, date-time, nullable
      - `firstScannerId` string: The firstScannerId field.
      - `reportingScanners` string[], nullable: The reportingScanners field.
      - `revokedAt` string, date-time, nullable
      - `sourceKind` string: The sourceKind field.
      - `sourceUrl` string: The sourceUrl field.
    - `custom` C1ApiFindingV1CustomFindingType: CustomFindingType: a user- or integration-authored finding. The discriminator carries no payload; the finding's content lives in description / remediation_description / custom_tags.
    - `customSubType` string: User-supplied sub-classification for custom findings (e.g. "shadow_it").
    - `customTags` object: Deprecated: use annotations instead. Read-only mirror of annotations; writes to this field are ignored.
    - `deactivatedOwner` C1ApiFindingV1DeactivatedOwnerType: DeactivatedOwnerType: the human responsible for a target -- either the AppUser's own correlated identity, an ownership_v2-assigned owner, or a secret's run-as identity is deactivated. Target: AppUserTarget or AppResourceTarget.
      - `source` 'DEACTIVATED_OWNER_SOURCE_UNSPECIFIED' | 'DEACTIVATED_OWNER_SOURCE_IDENTITY_CORRELATION' | 'DEACTIVATED_OWNER_SOURCE_OWNERSHIP_ASSIGNED' | 'DEACTIVATED_OWNER_SOURCE_SECRET_RUN_AS_IDENTITY': The source field.
    - `deactivatedOwnerEvidence` C1ApiFindingV1DeactivatedOwnerEvidence: The DeactivatedOwnerEvidence message.
      - `deactivatedOwners` C1ApiFindingV1DeactivatedOwnerDetail[], nullable: The deactivatedOwners field.
        - `reason` 'DEACTIVATED_OWNER_REASON_UNSPECIFIED' | 'DEACTIVATED_OWNER_REASON_USER_DELETED' | 'DEACTIVATED_OWNER_REASON_USER_DISABLED' | 'DEACTIVATED_OWNER_REASON_EMPLOYMENT_INACTIVE': The reason field.
        - `userId` string: The userId field.
    - `decoyCredentialUsed` C1ApiFindingV1DecoyCredentialUsedType: DecoyCredentialUsedType: a planted decoy credential authenticated successfully.
      - `decoyId` string: The decoyId field.
      - `kind` 'DECOY_CREDENTIAL_KIND_UNSPECIFIED' | 'DECOY_CREDENTIAL_KIND_USER_CLIENT_CREDENTIAL' | 'DECOY_CREDENTIAL_KIND_CONNECTOR_CLIENT' | 'DECOY_CREDENTIAL_KIND_WORKLOAD_FEDERATION' | 'DECOY_CREDENTIAL_KIND_ACCESS_TOKEN': The kind field.
    - `decoyPubliclyExposed` C1ApiFindingV1DecoyPubliclyExposedType: DecoyPubliclyExposedType: a planted decoy was reported as publicly exposed. Dedup is decoy_id.
      - `decoyDisplayName` string: The decoyDisplayName field.
      - `decoyId` string: The decoyId field.
    - `decoyPubliclyExposedEvidence` C1ApiFindingV1DecoyPubliclyExposedEvidence: DecoyPubliclyExposedEvidence mirrors CredentialPubliclyExposedEvidence for decoys.
      - `credentialRevoked` boolean: The credentialRevoked field.
      - `fingerprintPrefix` string: The fingerprintPrefix field.
      - `firstObservedAt` string, date-time, nullable
      - `firstScannerId` string: The firstScannerId field.
      - `reportingScanners` string[], nullable: The reportingScanners field.
      - `revokedAt` string, date-time, nullable
      - `sourceKind` string: The sourceKind field.
      - `sourceUrl` string: The sourceUrl field.
    - `decoyTarget` C1ApiFindingV1DecoyTarget: DecoyTarget points at the planted decoy that produced this finding. Populated for findings whose subject is the decoy artifact itself (e.g. decoy_credential_used), giving the UI and routing rules a uniform handle to the decoy alongside the finding_type payload.
      - `decoyId` string: The decoyId field.
    - `dedupKeyParts` string[], nullable: Caller-supplied dedup identity for custom findings; echoed back so IaC clients can roundtrip it. Empty for detector findings.
    - `description` string: User-authored finding body (markdown by convention). Set for custom findings.
    - `edgeFinding` C1ApiFindingV1EdgeFindingType: EdgeFindingType identifies an Edge finding: one rule matching one subject on one Edge. Target: TenantTarget.
      - `appId` string: The app the Edge belongs to.
      - `category` 'EDGE_FINDING_CATEGORY_UNSPECIFIED' | 'EDGE_FINDING_CATEGORY_DESTINATION_RISK' | 'EDGE_FINDING_CATEGORY_POLICY_HEALTH' | 'EDGE_FINDING_CATEGORY_DATA_VOLUME' | 'EDGE_FINDING_CATEGORY_IDENTITY' | 'EDGE_FINDING_CATEGORY_AI_USAGE' | 'EDGE_FINDING_CATEGORY_TRANSPORT' | 'EDGE_FINDING_CATEGORY_BEHAVIOR' | 'EDGE_FINDING_CATEGORY_EDGE_HEALTH': The category field.
      - `edgeId` string: The Edge (app resource id) whose traffic matched.
      - `ruleId` string: Stable rule id, e.g. "EDGE-DEST-FIRST-SEEN".
      - `subcategory` 'EDGE_FINDING_SUBCATEGORY_UNSPECIFIED' | 'EDGE_FINDING_SUBCATEGORY_AI_MODEL_GOVERNANCE' | 'EDGE_FINDING_SUBCATEGORY_AI_USAGE_COST' | 'EDGE_FINDING_SUBCATEGORY_AI_ATTRIBUTION' | 'EDGE_FINDING_SUBCATEGORY_AI_RELIABILITY': Set only for EDGE_FINDING_CATEGORY_AI_USAGE.
      - `subject` string: What the finding is about, e.g. a destination host.
    - `edgeFindingEvidence` C1ApiFindingV1EdgeFindingEvidence: EdgeFindingEvidence is the detail the Edge Findings tab renders.
      - `appId` string: Mirrors EdgeFindingType.app_id.
      - `category` 'EDGE_FINDING_CATEGORY_UNSPECIFIED' | 'EDGE_FINDING_CATEGORY_DESTINATION_RISK' | 'EDGE_FINDING_CATEGORY_POLICY_HEALTH' | 'EDGE_FINDING_CATEGORY_DATA_VOLUME' | 'EDGE_FINDING_CATEGORY_IDENTITY' | 'EDGE_FINDING_CATEGORY_AI_USAGE' | 'EDGE_FINDING_CATEGORY_TRANSPORT' | 'EDGE_FINDING_CATEGORY_BEHAVIOR' | 'EDGE_FINDING_CATEGORY_EDGE_HEALTH': The category field.
      - `edgeId` string: Mirrors EdgeFindingType.edge_id.
      - `evidence` C1ApiFindingV1EdgeFindingEvidenceKeyValue[], nullable: The evidence field.
        - `key` string: The key field.
        - `value` string: The value field.
      - `kind` string: Human-readable rule label, e.g. "First-seen destination".
      - `rank` string, uint64: Rule-specific measure of how much the rule matters for this subject (for example denied calls); higher is more suspicious; 0 when the rule defines none. Used to order findings within a rule.
      - `resourceKind` string: Which traffic the rule read: "egress" or "inference".
      - `ruleId` string: Mirrors EdgeFindingType.rule_id.
      - `subcategory` 'EDGE_FINDING_SUBCATEGORY_UNSPECIFIED' | 'EDGE_FINDING_SUBCATEGORY_AI_MODEL_GOVERNANCE' | 'EDGE_FINDING_SUBCATEGORY_AI_USAGE_COST' | 'EDGE_FINDING_SUBCATEGORY_AI_ATTRIBUTION' | 'EDGE_FINDING_SUBCATEGORY_AI_RELIABILITY': Mirrors EdgeFindingType.subcategory.
      - `subject` string: Mirrors EdgeFindingType.subject.
      - `summary` string: The summary field.
      - `windowDays` integer: Length of the detection window in days.
    - `fingerprint` string: The fingerprint field.
    - `firstObservedAt` string, date-time, nullable
    - `id` string: The id field.
    - `identityUserTarget` C1ApiFindingV1IdentityUserTarget: The IdentityUserTarget message.
      - `identityUserId` string: The identityUserId field.
    - `lastAppearedAt` string, date-time, nullable
    - `lastObservedAt` string, date-time, nullable
    - `mcpGatewayToolCallRisk` C1ApiFindingV1McpGatewayToolCallRiskType: McpGatewayToolCallRiskType: the discriminator carries no payload beyond itself -- the specific detection rule and subject live on McpGatewayToolCallRiskEvidence, since which fields are meaningful (a tool-call trace vs. a volume baseline vs. an unregistered server) varies per rule, not per dedup identity.
    - `mcpGatewayToolCallRiskEvidence` C1ApiFindingV1McpGatewayToolCallRiskEvidence: McpGatewayToolCallRiskEvidence carries the rule that fired and the subject/summary the UI renders. No detector writes this yet -- see FINDING_TYPE_MCP_GATEWAY_TOOL_CALL_RISK.
      - `evidence` C1ApiFindingV1McpGatewayToolCallRiskEvidenceKeyValue[], nullable: The evidence field.
        - `key` string: The key field.
        - `value` string: The value field.
      - `kind` string: Human-readable rule category, e.g. "Prompt injection in tool output".
      - `ruleId` string: Detection rule id, e.g. "MCP-201".
      - `subject` string: Human-readable subject, e.g. "agent-support-triage -> okta/reset_password".
      - `summary` string: The summary field.
    - `nhiUnowned` C1ApiFindingV1NhiUnownedType: NhiUnownedType: an AppResource with a non-human-identity type has no primary owner. Target: AppResourceTarget (the unowned NHI resource).
    - `nhiUnownedEvidence` C1ApiFindingV1NhiUnownedEvidence: The NhiUnownedEvidence message.
      - `checkedRoleSlug` string: The checkedRoleSlug field.
      - `ownerCount` integer: The ownerCount field.
      - `suggestedOwners` C1ApiFindingV1SuggestedOwner[], nullable: The suggestedOwners field.
        - `confidencePercent` integer: Max of reasons[].percent at detection time.
        - `reasons` C1ApiFindingV1SuggestedOwnerReason[], nullable: The reasons field.
          - `denominator` integer: The denominator field.
          - `kind` 'SUGGESTED_OWNER_REASON_KIND_UNSPECIFIED' | 'SUGGESTED_OWNER_REASON_KIND_CONNECTOR_REPORTED_OWNER' | 'SUGGESTED_OWNER_REASON_KIND_GRANT_ON_RESOURCE' | 'SUGGESTED_OWNER_REASON_KIND_CREDENTIAL_CREATOR' | 'SUGGESTED_OWNER_REASON_KIND_SIBLING_NHI_OWNER' | 'SUGGESTED_OWNER_REASON_KIND_APP_OWNER' | 'SUGGESTED_OWNER_REASON_KIND_MANAGER_OF_INACTIVE_CANDIDATE': The kind field.
          - `numerator` integer: The numerator field.
          - `percent` integer: 0..100, derived from numerator / denominator.
          - `relatedId` string: Entitlement, sibling resource or replaced user ID; never free text.
        - `userId` string: C1 User ID; readers resolve the name.
    - `objectPermissions` C1ApiAuthorizationV1ActorObjectPermissions: ActorObjectPermissions describes which actions the calling user is permitted to perform on an object, as determined by policy.
      - `delete` boolean: The delete field.
      - `edit` boolean: The edit field.
      - `extra` object: The extra field.
      - `read` boolean: The read field.
    - `recurrenceCount` integer: The recurrenceCount field.
    - `remediationDescription` string: The remediationDescription field.
    - `resolvedAt` string, date-time, nullable
    - `riskAcceptanceExpiresAt` string, date-time, nullable
    - `riskAcceptanceJustification` string: The riskAcceptanceJustification field.
    - `riskScore` C1ApiFindingV1FindingRiskScore: The FindingRiskScore message.
      - `originalScore` integer: The originalScore field.
      - `overrideByUserId` string: The overrideByUserId field.
      - `overrideScore` integer: The overrideScore field.
      - `riskFactors` C1ApiFindingV1FindingRiskFactor[], nullable: The riskFactors field.
        - `description` string: The description field.
        - `name` string: The name field.
        - `severity` 'FINDING_SEVERITY_UNSPECIFIED' | 'FINDING_SEVERITY_INFO' | 'FINDING_SEVERITY_LOW' | 'FINDING_SEVERITY_MEDIUM' | 'FINDING_SEVERITY_HIGH' | 'FINDING_SEVERITY_CRITICAL': The severity field.
        - `weight` integer: The weight field.
      - `score` integer: The score field.
      - `systemScore` integer: The systemScore field.
    - `serviceAccountMisclassification` C1ApiFindingV1ServiceAccountMisclassificationType: The ServiceAccountMisclassificationType message.
      - `currentAccountType` 'APP_USER_TYPE_UNSPECIFIED' | 'APP_USER_TYPE_USER' | 'APP_USER_TYPE_SERVICE_ACCOUNT' | 'APP_USER_TYPE_SYSTEM_ACCOUNT': The currentAccountType field.
      - `detectedAccountType` 'APP_USER_TYPE_UNSPECIFIED' | 'APP_USER_TYPE_USER' | 'APP_USER_TYPE_SERVICE_ACCOUNT' | 'APP_USER_TYPE_SYSTEM_ACCOUNT': The detectedAccountType field.
    - `serviceAccountMisclassificationEvidence` C1ApiFindingV1ServiceAccountMisclassificationEvidence: The ServiceAccountMisclassificationEvidence message.
      - `detectionReason` string: The detectionReason field.
    - `serviceAccountUnowned` C1ApiFindingV1ServiceAccountUnownedType: ServiceAccountUnownedType: a service-account-classified AppUser has no primary owner. Target: AppUserTarget (the unowned service account).
    - `severity` 'FINDING_SEVERITY_UNSPECIFIED' | 'FINDING_SEVERITY_INFO' | 'FINDING_SEVERITY_LOW' | 'FINDING_SEVERITY_MEDIUM' | 'FINDING_SEVERITY_HIGH' | 'FINDING_SEVERITY_CRITICAL': The severity field.
    - `shadowApp` C1ApiFindingV1ShadowAppType: ShadowAppType: a UsageResource was discovered outside the tenant's governed connector reach. Dedup is the full UsageResource identity, so the type payload carries nothing beyond the discriminator itself -- the complete identity lives on usage_resource_target.
    - `shadowMcp` C1ApiFindingV1ShadowMcpType: ShadowMcpType: a device is running an MCP server that isn't reached through the tenant's governed MCP gateway. Dedup is mcp_identifier -- one finding per tenant per distinct MCP product, regardless of how many users/devices/harnesses run it. Target: TenantTarget.
      - `mcpIdentifier` string: Stable identity of the MCP product, shared across every user/device/harness that runs it. Maps to DeviceInventoryMcpObservation.logical_product_key; display name is resolved from there, not duplicated here.
      - `transport` 'SHADOW_MCP_TRANSPORT_UNSPECIFIED' | 'SHADOW_MCP_TRANSPORT_STDIO' | 'SHADOW_MCP_TRANSPORT_REMOTE': Denormalized from DeviceInventoryMcpObservation.transport at detection time. Distinguishes a locally-launched (STDIO) product, which has no address to connect to, from a remote one, which does.
    - `shadowMcpEvidence` C1ApiFindingV1ShadowMcpEvidence: ShadowMcpEvidence carries counts only -- occurrence detail (which users, devices, harnesses) is resolved dynamically, not stored here.
      - `deviceCount` integer: Distinct devices observed running the product outside the governed gateway.
      - `userCount` integer: Distinct users observed running the product outside the governed gateway.
    - `similarUsernameMatch` C1ApiFindingV1SimilarUsernameMatchType: The SimilarUsernameMatchType message.
      - `proposedIdentityUserId` string: The proposedIdentityUserId field.
    - `similarUsernameMatchEvidence` C1ApiFindingV1SimilarUsernameMatchEvidence: The SimilarUsernameMatchEvidence message.
      - `appUsername` string: The appUsername field.
      - `identityUsername` string: The identityUsername field.
      - `similarityScore` number: The similarityScore field.
    - `snoozeReason` string: The snoozeReason field.
    - `snoozeUntil` string, date-time, nullable
    - `sourceDetectorId` string: The sourceDetectorId field.
    - `sourceKind` 'FINDING_SOURCE_KIND_UNSPECIFIED' | 'FINDING_SOURCE_KIND_DETECTOR' | 'FINDING_SOURCE_KIND_EXTERNAL': Who authored the finding (detector, user, external).
    - `state` 'FINDING_STATE_UNSPECIFIED' | 'FINDING_STATE_OPEN' | 'FINDING_STATE_IN_PROGRESS' | 'FINDING_STATE_RESOLVED' | 'FINDING_STATE_SNOOZED' | 'FINDING_STATE_RISK_ACCEPTED' | 'FINDING_STATE_SUPPRESSED': The state field.
    - `stateUpdatedById` string: The human who authored the CURRENT state. Empty when a routing rule or the system authored it, so do not read a populated value as "this finding has a human owner" -- read it as "a human set the state it is in right now".
    - `suppressReason` string: The suppressReason field.
    - `taskId` string: The taskId field.
    - `tenantTarget` C1ApiFindingV1TenantTarget: TenantTarget scopes a finding to the whole tenant. It carries no subject id; the finding's tenant is the scope.
    - `unusedSecret` C1ApiFindingV1UnusedSecretType: UnusedSecretType: a secret-trait AppResource has not been used in over the detector's staleness threshold. Target: AppResourceTarget.
    - `unusedSecretEvidence` C1ApiFindingV1UnusedSecretEvidence: The UnusedSecretEvidence message.
      - `lastUsedAt` string, date-time, nullable
    - `updatedAt` string, date-time, nullable
    - `usageResourceTarget` C1ApiUsageEventV1UsageResourceRef: The UsageResourceRef message.
      - `appId` string: The appId field.
      - `connectorId` string: The connectorId field.
      - `resourceId` string: The resourceId field.
      - `resourceTypeId` string: The resourceTypeId field.

## Changes

- **2026-10-20** `fe943bedf41b`: 1 info
  - added the optional property `finding/oneOf[subschema #1: Finding]/nhiUnownedEvidence` to the response with the `200` status
- **2026-10-06** `918a4e749f56`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/conductorone/apis/c1-api/changes/api/v1/findings/:finding_id/assignee/post.md)

---

[API](https://skmtc.dev/conductorone/apis/c1-api.md) - [All operations](https://skmtc.dev/conductorone/apis/c1-api/llms.txt) - [OpenAPI document](https://skmtc.dev/conductorone/apis/c1-api/revisions/fe943bedf41b?raw)