--- title: "Search Policy Users" method: POST path: "/api/v1/session-policies/{id}/users/search" tags: ["Session Policy"] --- # Search Policy Users `POST /api/v1/session-policies/{id}/users/search` ## Request - Base URL: `https://example.conductor.one` - URL: `https://example.conductor.one/api/v1/session-policies/{id}/users/search` - Auth: HTTP bearer and OAuth 2 - Client credentials - Token URL: `/auth/v1/token` Searches the users a policy applies to, expanded: direct assignments plus per-user expansion of conferred groups, one page at a time. Served from the asynchronously-replicated Postgres mirror of the binding store, so a just-made assignment may not appear immediately; the user-scoped reads (GetEffectiveSessionPolicy, ListUserPolicies) reflect current state. Search, not List: the results are a filtered, server-paginated discovery over the binding store (query and source facets), not a bounded collection of a named object. ## Path parameters - `id` string, required: The session policy whose applied users to search. ## Request body - C1ApiSessionPolicyV1SessionPolicyServiceSearchPolicyUsersRequestInput: SessionPolicyServiceSearchPolicyUsersRequest searches the users a policy applies to, one page at a time. This read is served from the asynchronously-replicated Postgres mirror of the binding store, so a just-made assignment may not appear immediately; the user-scoped reads (GetEffectiveSessionPolicy, ListUserPolicies) reflect current state. - `pageSize` integer: The maximum number of users to return per page. The server clamps this to its own bounds (currently 5..100). Always follow next_page_token to complete the search. - `pageToken` string: The page token from the previous response. - `query` string: Fuzzy search on user display name and email. Empty matches all users the policy applies to. Applied in the query together with the source facet, so pages carry only matching rows. - `source` 'EFFECTIVE_SESSION_POLICY_SOURCE_FILTER_UNSPECIFIED' | 'EFFECTIVE_SESSION_POLICY_SOURCE_FILTER_DIRECT' | 'EFFECTIVE_SESSION_POLICY_SOURCE_FILTER_GROUP': When set, restrict results to this source. UNSPECIFIED returns all users. ## Response `200` SessionPolicyServiceSearchPolicyUsersResponse carries one page of the users a policy applies to. - C1ApiSessionPolicyV1SessionPolicyServiceSearchPolicyUsersResponse: SessionPolicyServiceSearchPolicyUsersResponse carries one page of the users a policy applies to. - `nextPageToken` string: The token for the next page. Empty when this is the last page. - `users` C1ApiSessionPolicyV1PolicyUser[], nullable: The users on this page. - `group` C1ApiAppV1AppEntitlement: The app entitlement represents one permission in a downstream App (SAAS) that can be granted. For example, GitHub Read vs GitHub Write. This message contains a oneof named max_grant_duration. Only a single field of the following list may be set at a time: - durationUnset - durationGrant - `alias` string: The alias of the app entitlement used by Cone. Also exact-match queryable. - `annotations` object: Bounded key/value metadata bag for IaC marking and customer tags. See .rfcs/object-annotations.md §2. Limits: ≤16 entries; keys 1–128 chars matching ^[A-Za-z][A-Za-z0-9._/-]{0,127}$; values 0–256 chars URL-safe ASCII; total serialized ≤ 4096 bytes. Keys matching ^c1/ are reserved. Well-known keys: `managed_by`, `iac_workspace`, `iac_resource_address`, `iac_tool_version`. - `appId` string: The ID of the app that is associated with the app entitlement. - `appResourceId` string: The ID of the app resource that is associated with the app entitlement - `appResourceTypeId` string: The ID of the app resource type that is associated with the app entitlement - `certifyPolicyId` string: The ID of the policy that will be used for certify tickets related to the app entitlement. - `complianceFrameworkValueIds` string[], nullable: The IDs of different compliance frameworks associated with this app entitlement ex (SOX, HIPAA, PCI, etc.) - `createdAt` string, date-time, nullable - `defaultValuesApplied` boolean: Flag to indicate if app-level access request defaults have been applied to the entitlement - `deletedAt` string, date-time, nullable - `deprovisionerPolicy` C1ApiPolicyV1ProvisionPolicy: ProvisionPolicy is a oneOf that indicates how a provision step should be processed. This message contains a oneof named typ. Only a single field of the following list may be set at a time: - connector - manual - delegated - webhook - multiStep - externalTicket - unconfigured - action - devicePlacement - `action` C1ApiPolicyV1ActionProvision: This provision step indicates that account lifecycle action should be called to provision this entitlement. - `actionName` string: The actionName field. - `appId` string: The appId field. - `connectorId` string: The connectorId field. - `displayName` string: The displayName field. - `connector` C1ApiPolicyV1ConnectorProvision: Indicates that a connector should perform the provisioning. This object has no fields. This message contains a oneof named provision_type. Only a single field of the following list may be set at a time: - defaultBehavior - account - deleteAccount - `account` C1ApiPolicyV1ConnectorProvisionAccountProvision: The AccountProvision message. This message contains a oneof named storage_type. Only a single field of the following list may be set at a time: - saveToVault - doNotSave - `config` object, nullable - `connectorId` string: The connectorId field. - `doNotSave` C1ApiPolicyV1ConnectorProvisionDoNotSave: The DoNotSave message. - `saveToVault` C1ApiPolicyV1ConnectorProvisionSaveToVault: The SaveToVault message. - … - `schemaId` string: The schemaId field. - `defaultBehavior` C1ApiPolicyV1ConnectorProvisionDefaultBehavior: The DefaultBehavior message. - `connectorId` string: this checks if the entitlement is enabled by provisioning in a specific connector this can happen automatically and doesn't need any extra info - `deleteAccount` C1ApiPolicyV1ConnectorProvisionDeleteAccount: The DeleteAccount message. - `connectorId` string: The connectorId field. - `delegated` C1ApiPolicyV1DelegatedProvision: This provision step indicates that we should delegate provisioning to the configuration of another app entitlement. This app entitlement does not have to be one from the same app, but MUST be configured as a proxy binding leading into this entitlement. - `appId` string: The AppID of the entitlement to delegate provisioning to. - `entitlementId` string: The ID of the entitlement we are delegating provisioning to. - `implicit` boolean: If true, a binding will be automatically created from the entitlement of the parent app. - `devicePlacement` C1ApiPolicyV1DevicePlacementProvision: This provision step is fulfilled by a Latchkey member device producing an MLS Welcome for the recipient. It has no assignee and no instructions because the step is not human-actionable. - `vaultBoundaryId` string: The vaultBoundaryId field. - `externalTicket` C1ApiPolicyV1ExternalTicketProvision: This provision step indicates that we should check an external ticket to provision this entitlement - `appId` string: The appId field. - `connectorId` string: The connectorId field. - `externalTicketProvisionerConfigId` string: The externalTicketProvisionerConfigId field. - `instructions` string: This field indicates a text body of instructions for the provisioner to indicate. - `manual` C1ApiPolicyV1ManualProvision: Manual provisioning indicates that a human must intervene for the provisioning of this step. - `assignee` C1ApiPolicyV1ProvisionerAssignment: ProvisionerAssignment defines how a provisioner is dynamically assigned. This message contains a oneof named typ. Only a single field of the following list may be set at a time: - users - appOwners - group - manager - expression - entitlementOwners - `appOwners` C1ApiPolicyV1AppOwnerProvisioner: AppOwnerProvisioner resolves to app owners. - … - `entitlementOwners` C1ApiPolicyV1EntitlementOwnerProvisioner: EntitlementOwnerProvisioner resolves to entitlement owners. - … - `expression` C1ApiPolicyV1ExpressionProvisioner: ExpressionProvisioner evaluates CEL expressions to determine provisioners. - … - `group` C1ApiPolicyV1GroupProvisioner: GroupProvisioner resolves to members of a specific group. - … - `manager` C1ApiPolicyV1ManagerProvisioner: ManagerProvisioner resolves to the user's manager. - … - `users` C1ApiPolicyV1UserProvisioner: UserProvisioner assigns specific users as provisioners. - … - `instructions` string: This field indicates a text body of instructions for the provisioner to indicate. - `userIds` string[], nullable: An array of users that are required to provision during this step. Deprecated: Use assignee field instead for dynamic provisioner assignment. - `multiStep` C1ApiPolicyV1MultiStep: MultiStep indicates that this provision step has multiple steps to process. - `provisionSteps` C1ApiPolicyV1ProvisionPolicy[], nullable: The array of provision steps to process. - `unconfigured` C1ApiPolicyV1UnconfiguredProvision: The UnconfiguredProvision message. - `webhook` C1ApiPolicyV1WebhookProvision: This provision step indicates that a webhook should be called to provision this entitlement. - `webhookId` string: The ID of the webhook to call for provisioning. - `description` string: The description of the app entitlement. - `displayName` string: The display name of the app entitlement. - `durationGrant` string, duration, nullable - `durationUnset` object, nullable - `emergencyGrantEnabled` boolean: This enables tasks to be created in an emergency and use a selected emergency access policy. - `emergencyGrantPolicyId` string: The ID of the policy that will be used for emergency access grant tasks. - `externalId` string: The upstream product's native external ID for this entitlement (e.g. an Okta group ID). Populated from the connector's external ID during sync. - `grantCount` string, int64: The amount of grants open for this entitlement - `grantPolicyId` string: The ID of the policy that will be used for grant tickets related to the app entitlement. - `id` string: The unique ID for the App Entitlement. - `isAutomationEnabled` boolean: Flag to indicate whether automation (for adding users to entitlement based on rules) has been enabled. - `isManuallyManaged` boolean: Flag to indicate if the app entitlement is manually managed. - `matchBatonId` string: An identifier used to match this entitlement to a connector-synced entitlement during sync. - `overrideAccessRequestsDefaults` boolean: Flag to indicate if the app-level access request settings have been overridden for the entitlement - `provisionerPolicy` C1ApiPolicyV1ProvisionPolicy: ProvisionPolicy is a oneOf that indicates how a provision step should be processed. This message contains a oneof named typ. Only a single field of the following list may be set at a time: - connector - manual - delegated - webhook - multiStep - externalTicket - unconfigured - action - devicePlacement - `action` C1ApiPolicyV1ActionProvision: This provision step indicates that account lifecycle action should be called to provision this entitlement. - `actionName` string: The actionName field. - `appId` string: The appId field. - `connectorId` string: The connectorId field. - `displayName` string: The displayName field. - `connector` C1ApiPolicyV1ConnectorProvision: Indicates that a connector should perform the provisioning. This object has no fields. This message contains a oneof named provision_type. Only a single field of the following list may be set at a time: - defaultBehavior - account - deleteAccount - `account` C1ApiPolicyV1ConnectorProvisionAccountProvision: The AccountProvision message. This message contains a oneof named storage_type. Only a single field of the following list may be set at a time: - saveToVault - doNotSave - `config` object, nullable - `connectorId` string: The connectorId field. - `doNotSave` C1ApiPolicyV1ConnectorProvisionDoNotSave: The DoNotSave message. - `saveToVault` C1ApiPolicyV1ConnectorProvisionSaveToVault: The SaveToVault message. - … - `schemaId` string: The schemaId field. - `defaultBehavior` C1ApiPolicyV1ConnectorProvisionDefaultBehavior: The DefaultBehavior message. - `connectorId` string: this checks if the entitlement is enabled by provisioning in a specific connector this can happen automatically and doesn't need any extra info - `deleteAccount` C1ApiPolicyV1ConnectorProvisionDeleteAccount: The DeleteAccount message. - `connectorId` string: The connectorId field. - `delegated` C1ApiPolicyV1DelegatedProvision: This provision step indicates that we should delegate provisioning to the configuration of another app entitlement. This app entitlement does not have to be one from the same app, but MUST be configured as a proxy binding leading into this entitlement. - `appId` string: The AppID of the entitlement to delegate provisioning to. - `entitlementId` string: The ID of the entitlement we are delegating provisioning to. - `implicit` boolean: If true, a binding will be automatically created from the entitlement of the parent app. - `devicePlacement` C1ApiPolicyV1DevicePlacementProvision: This provision step is fulfilled by a Latchkey member device producing an MLS Welcome for the recipient. It has no assignee and no instructions because the step is not human-actionable. - `vaultBoundaryId` string: The vaultBoundaryId field. - `externalTicket` C1ApiPolicyV1ExternalTicketProvision: This provision step indicates that we should check an external ticket to provision this entitlement - `appId` string: The appId field. - `connectorId` string: The connectorId field. - `externalTicketProvisionerConfigId` string: The externalTicketProvisionerConfigId field. - `instructions` string: This field indicates a text body of instructions for the provisioner to indicate. - `manual` C1ApiPolicyV1ManualProvision: Manual provisioning indicates that a human must intervene for the provisioning of this step. - `assignee` C1ApiPolicyV1ProvisionerAssignment: ProvisionerAssignment defines how a provisioner is dynamically assigned. This message contains a oneof named typ. Only a single field of the following list may be set at a time: - users - appOwners - group - manager - expression - entitlementOwners - `appOwners` C1ApiPolicyV1AppOwnerProvisioner: AppOwnerProvisioner resolves to app owners. - … - `entitlementOwners` C1ApiPolicyV1EntitlementOwnerProvisioner: EntitlementOwnerProvisioner resolves to entitlement owners. - … - `expression` C1ApiPolicyV1ExpressionProvisioner: ExpressionProvisioner evaluates CEL expressions to determine provisioners. - … - `group` C1ApiPolicyV1GroupProvisioner: GroupProvisioner resolves to members of a specific group. - … - `manager` C1ApiPolicyV1ManagerProvisioner: ManagerProvisioner resolves to the user's manager. - … - `users` C1ApiPolicyV1UserProvisioner: UserProvisioner assigns specific users as provisioners. - … - `instructions` string: This field indicates a text body of instructions for the provisioner to indicate. - `userIds` string[], nullable: An array of users that are required to provision during this step. Deprecated: Use assignee field instead for dynamic provisioner assignment. - `multiStep` C1ApiPolicyV1MultiStep: MultiStep indicates that this provision step has multiple steps to process. - `provisionSteps` C1ApiPolicyV1ProvisionPolicy[], nullable: The array of provision steps to process. - `unconfigured` C1ApiPolicyV1UnconfiguredProvision: The UnconfiguredProvision message. - `webhook` C1ApiPolicyV1WebhookProvision: This provision step indicates that a webhook should be called to provision this entitlement. - `webhookId` string: The ID of the webhook to call for provisioning. - `purpose` 'APP_ENTITLEMENT_PURPOSE_VALUE_UNSPECIFIED' | 'APP_ENTITLEMENT_PURPOSE_VALUE_ASSIGNMENT' | 'APP_ENTITLEMENT_PURPOSE_VALUE_PERMISSION' | 'APP_ENTITLEMENT_PURPOSE_VALUE_OWNERSHIP': The purpose of this entitlement (e.g., assignment, permission, ownership). - `requestSchemaId` string: The ID of the request schema associated with this app entitlement. - `revokePolicyId` string: The ID of the policy that will be used for revoke tickets related to the app entitlement - `riskLevelValueId` string: The ID of the risk level assigned to this entitlement. - `slug` string: The slug is displayed as an oval next to the name in the frontend of C1, it tells you what permission the entitlement grants. See https://www.conductorone.com/docs/product/admin/entitlements/ - `sourceConnectorIds` object: Map to tell us which connector the entitlement came from. - `systemBuiltin` boolean: This field indicates if this is a system builtin entitlement. - `updatedAt` string, date-time, nullable - `userEditedMask` string, nullable - `source` 'EFFECTIVE_SESSION_POLICY_SOURCE_UNSPECIFIED' | 'EFFECTIVE_SESSION_POLICY_SOURCE_DIRECT' | 'EFFECTIVE_SESSION_POLICY_SOURCE_GROUP' | 'EFFECTIVE_SESSION_POLICY_SOURCE_TENANT_DEFAULT' | 'EFFECTIVE_SESSION_POLICY_SOURCE_TENANT_DEFAULT_NONE': Why the policy applies to this user. DIRECT or GROUP. - `user` C1ApiUserV1User: The User object provides all of the details for an user, as well as some configuration. - `createdAt` string, date-time, nullable - `delegatedUserId` string: The id of the user to whom tasks will be automatically reassigned to. - `deletedAt` string, date-time, nullable - `department` string: The department which the user belongs to in the organization. - `departmentSources` C1ApiUserV1UserAttributeMappingSource[], nullable: A list of objects mapped based on department attribute mappings configured in the system. - `appId` string: The appId field. - `appUserId` string: The appUserId field. - `appUserProfileAttributeKey` string: The appUserProfileAttributeKey field. - `priority` integer: Lower number = higher precedence; sources[0] is the winning source. - `userAttributeMappingId` string: The userAttributeMappingId field. - `value` string: The value field. - `directoryIds` string[], nullable: A list of unique ids that represent different directories. - `directoryStatus` 'UNKNOWN' | 'ENABLED' | 'DISABLED' | 'DELETED': The status of the user in the directory. - `directoryStatusSources` C1ApiUserV1UserAttributeMappingSource[], nullable: A list of objects mapped based on directoryStatus attribute mappings configured in the system. - `appId` string: The appId field. - `appUserId` string: The appUserId field. - `appUserProfileAttributeKey` string: The appUserProfileAttributeKey field. - `priority` integer: Lower number = higher precedence; sources[0] is the winning source. - `userAttributeMappingId` string: The userAttributeMappingId field. - `value` string: The value field. - `displayName` string: The display name of the user. - `email` string: This is the user's email. - `emailSources` C1ApiUserV1UserAttributeMappingSource[], nullable: A list of source data for the email attribute. - `appId` string: The appId field. - `appUserId` string: The appUserId field. - `appUserProfileAttributeKey` string: The appUserProfileAttributeKey field. - `priority` integer: Lower number = higher precedence; sources[0] is the winning source. - `userAttributeMappingId` string: The userAttributeMappingId field. - `value` string: The value field. - `emails` string[], nullable: This is a list of all of the user's emails from app users. - `employeeIdSources` C1ApiUserV1UserAttributeMappingSource[], nullable: A list of source data for the employee IDs attribute. - `appId` string: The appId field. - `appUserId` string: The appUserId field. - `appUserProfileAttributeKey` string: The appUserProfileAttributeKey field. - `priority` integer: Lower number = higher precedence; sources[0] is the winning source. - `userAttributeMappingId` string: The userAttributeMappingId field. - `value` string: The value field. - `employeeIds` string[], nullable: This is a list of all of the user's employee IDs from app users. - `employmentStatus` string: The users employment status. - `employmentStatusSources` C1ApiUserV1UserAttributeMappingSource[], nullable: A list of objects mapped based on employmentStatus attribute mappings configured in the system. - `appId` string: The appId field. - `appUserId` string: The appUserId field. - `appUserProfileAttributeKey` string: The appUserProfileAttributeKey field. - `priority` integer: Lower number = higher precedence; sources[0] is the winning source. - `userAttributeMappingId` string: The userAttributeMappingId field. - `value` string: The value field. - `employmentType` string: The employment type of the user. - `employmentTypeSources` C1ApiUserV1UserAttributeMappingSource[], nullable: A list of objects mapped based on employmentType attribute mappings configured in the system. - `appId` string: The appId field. - `appUserId` string: The appUserId field. - `appUserProfileAttributeKey` string: The appUserProfileAttributeKey field. - `priority` integer: Lower number = higher precedence; sources[0] is the winning source. - `userAttributeMappingId` string: The userAttributeMappingId field. - `value` string: The value field. - `id` string: A unique identifier of the user. - `jobTitle` string: The job title of the user. - `jobTitleSources` C1ApiUserV1UserAttributeMappingSource[], nullable: A list of objects mapped based on jobTitle attribute mappings configured in the system. - `appId` string: The appId field. - `appUserId` string: The appUserId field. - `appUserProfileAttributeKey` string: The appUserProfileAttributeKey field. - `priority` integer: Lower number = higher precedence; sources[0] is the winning source. - `userAttributeMappingId` string: The userAttributeMappingId field. - `value` string: The value field. - `managerIds` string[], nullable: A list of ids of the user's managers. - `managerSources` C1ApiUserV1UserAttributeMappingSource[], nullable: A list of objects mapped based on managerId attribute mappings configured in the system. - `appId` string: The appId field. - `appUserId` string: The appUserId field. - `appUserProfileAttributeKey` string: The appUserProfileAttributeKey field. - `priority` integer: Lower number = higher precedence; sources[0] is the winning source. - `userAttributeMappingId` string: The userAttributeMappingId field. - `value` string: The value field. - `origin` 'USER_ORIGIN_UNSPECIFIED' | 'USER_ORIGIN_DIRECTORY' | 'USER_ORIGIN_LOCAL' | 'USER_ORIGIN_SYSTEM': The origin of the user, describing who owns the user's lifecycle. - `profile` object, nullable - `roleIds` string[], nullable: A list of unique identifiers that maps to ConductorOne's user roles let you assign users permissions tailored to the work they do in the software. - `status` 'UNKNOWN' | 'ENABLED' | 'DISABLED' | 'DELETED': The status of the user in the system. - `type` 'USER_TYPE_UNSPECIFIED' | 'USER_TYPE_SYSTEM' | 'USER_TYPE_HUMAN' | 'USER_TYPE_SERVICE' | 'USER_TYPE_AGENT': The type of the user. - `updatedAt` string, date-time, nullable - `username` string: This is the user's primary username. Typically sourced from the primary directory. - `usernameSources` C1ApiUserV1UserAttributeMappingSource[], nullable: A list of source data for the usernames attribute. - `appId` string: The appId field. - `appUserId` string: The appUserId field. - `appUserProfileAttributeKey` string: The appUserProfileAttributeKey field. - `priority` integer: Lower number = higher precedence; sources[0] is the winning source. - `userAttributeMappingId` string: The userAttributeMappingId field. - `value` string: The value field. - `usernames` string[], nullable: This is a list of all of the user's usernames from app users. ## Changes - **2026-10-06** `918a4e749f56`: 1 info - endpoint added [Operation history](https://skmtc.dev/conductorone/apis/c1-api/changes/api/v1/session-policies/:id/users/search/post.md) --- [API](https://skmtc.dev/conductorone/apis/c1-api.md) - [All operations](https://skmtc.dev/conductorone/apis/c1-api/llms.txt) - [OpenAPI document](https://skmtc.dev/conductorone/apis/c1-api/revisions/fe943bedf41b?raw)