---
title: "Search"
method: POST
path: "/api/v1/search/shadow_mcp_occurrences"
tags: ["Findings"]
---

# Search

`POST /api/v1/search/shadow_mcp_occurrences`

## Request

- Base URL: `https://example.conductor.one`
- URL: `https://example.conductor.one/api/v1/search/shadow_mcp_occurrences`
- Auth: HTTP bearer and OAuth 2
  - Client credentials
  - Token URL: `/auth/v1/token`

Search returns the ungoverned, enabled observation rows behind one
 shadow-mcp finding -- the same present-set that produced its evidence
 counts. Authorized as VIEWER -- the same role required to read the
 finding itself.

## Request body

- C1ApiFindingV1ShadowMcpOccurrenceServiceSearchRequest: The ShadowMcpOccurrenceServiceSearchRequest message.
  - `findingId` string: The shadow-mcp finding to resolve occurrences for.
  - `pageSize` integer: The pageSize field.
  - `pageToken` string: The pageToken field.

## Response `200`

Successful response

- C1ApiFindingV1ShadowMcpOccurrenceServiceSearchResponse: The ShadowMcpOccurrenceServiceSearchResponse message.
  - `list` C1ApiFindingV1ShadowMcpOccurrence[], nullable: The list field.
    - `deviceId` string: The deviceId field.
    - `firstSeenAt` string, date-time, nullable
    - `harnessKind` string: The harnessKind field.
    - `lastSeenAt` string, date-time, nullable
    - `userId` string: Resolved owner of the device (device_registration's user_principal_id). Empty when the device has no resolved owner.
  - `nextPageToken` string: The nextPageToken field.

## Changes

- **2026-10-06** `918a4e749f56`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/conductorone/apis/c1-api/changes/api/v1/search/shadow_mcp_occurrences/post.md)

---

[API](https://skmtc.dev/conductorone/apis/c1-api.md) - [All operations](https://skmtc.dev/conductorone/apis/c1-api/llms.txt) - [OpenAPI document](https://skmtc.dev/conductorone/apis/c1-api/revisions/fe943bedf41b?raw)