---
title: "Search Denials"
method: POST
path: "/api/v1/spend-insights/denials/search"
tags: ["Spend Insights"]
---

# Search Denials

`POST /api/v1/spend-insights/denials/search`

## Request

- Base URL: `https://example.conductor.one`
- URL: `https://example.conductor.one/api/v1/spend-insights/denials/search`
- Auth: HTTP bearer and OAuth 2
  - Client credentials
  - Token URL: `/auth/v1/token`

Search budget-denial episodes for the organization within a time window.
 Requires the denial-read permission.

## Request body

- C1ApiSpendinsightsV1SearchDenialsRequest: SearchDenialsRequest specifies denial filters and pagination.
  - `filters` C1ApiSpendinsightsV1DenialFilters: DenialFilters selects budget-denial episodes.
    - `authorityId` string: Optional authority ID to match. Set authority_kind with this field.
    - `authorityKind` 'AUTHORITY_KIND_UNSPECIFIED' | 'AUTHORITY_KIND_FUND_POLICY' | 'AUTHORITY_KIND_FUND_ASSIGNMENT' | 'AUTHORITY_KIND_FUND_RULE' | 'AUTHORITY_KIND_TENANT_APP_CAP' | 'AUTHORITY_KIND_SUBJECT_APP_LIMIT' | 'AUTHORITY_KIND_ENTITLEMENT_BINDING' | 'AUTHORITY_KIND_APP_USER' | 'AUTHORITY_KIND_USER': Optional authority type to match. Set authority_id with this field.
    - `departments` string[], nullable: Optional current user departments to match. Only subject-scoped denials with a live, non-deleted user row can match; organization-scoped, application-scoped, missing-user, and deleted-user denials are excluded. Department is resolved from scope_user_id at read time, not captured from the denial event.
    - `endTime` string, date-time, nullable
    - `scopeAppId` string: Optional application scope ID to match.
    - `scopeKind` 'SPEND_SCOPE_KIND_UNSPECIFIED' | 'SPEND_SCOPE_KIND_TENANT' | 'SPEND_SCOPE_KIND_SUBJECT' | 'SPEND_SCOPE_KIND_APP' | 'SPEND_SCOPE_KIND_SUBJECT_APP': Optional budget scope to match.
    - `scopeUserId` string: Optional user scope ID to match.
    - `startTime` string, date-time, nullable
    - `state` 'SPEND_BLOCK_STATE_UNSPECIFIED' | 'SPEND_BLOCK_STATE_OPEN' | 'SPEND_BLOCK_STATE_CLOSED': Optional current episode state to match.
  - `pageSize` integer: Maximum number of episodes to return. The default is 25 and the maximum is 100.
  - `pageToken` string: Pagination token from a previous response with the same filters.

## Response `200`

SearchDenialsResponse contains one page of denial episodes.

- C1ApiSpendinsightsV1SearchDenialsResponse: SearchDenialsResponse contains one page of denial episodes.
  - `episodes` C1ApiSpendinsightsV1DenialEpisode[], nullable: Episodes ordered by most recent refusal, then unique ID, both descending.
    - `attemptCount` string, int64: Best-effort lower bound for refused calls in this episode. Concurrent retry exhaustion can under-report; denial_events is exact for a window.
    - `authorityId` string: Identifier of the configuration that supplied the denying limit.
    - `authorityKind` 'AUTHORITY_KIND_UNSPECIFIED' | 'AUTHORITY_KIND_FUND_POLICY' | 'AUTHORITY_KIND_FUND_ASSIGNMENT' | 'AUTHORITY_KIND_FUND_RULE' | 'AUTHORITY_KIND_TENANT_APP_CAP' | 'AUTHORITY_KIND_SUBJECT_APP_LIMIT' | 'AUTHORITY_KIND_ENTITLEMENT_BINDING' | 'AUTHORITY_KIND_APP_USER' | 'AUTHORITY_KIND_USER': Type of configuration that supplied the denying limit.
    - `authorityVersion` string, int64: Version of the configuration used for the first refusal.
    - `blockId` string: Unique identifier for this denial episode.
    - `budgetKey` string: Stable identifier for the budget account that denied the calls.
    - `closedAt` string, date-time, nullable
    - `firstDeniedAt` string, date-time, nullable
    - `lastDeniedAt` string, date-time, nullable
    - `periodEnd` string, date-time, nullable
    - `periodKey` string: Stable key for the denied budget period.
    - `periodKind` 'PERIOD_KIND_UNSPECIFIED' | 'PERIOD_KIND_DAILY' | 'PERIOD_KIND_WEEKLY' | 'PERIOD_KIND_MONTHLY' | 'PERIOD_KIND_QUARTERLY' | 'PERIOD_KIND_YEARLY': Length of the denied budget period.
    - `periodStart` string, date-time, nullable
    - `reason` 'SPEND_DENY_REASON_UNSPECIFIED' | 'SPEND_DENY_REASON_TENANT_FROZEN' | 'SPEND_DENY_REASON_SUSPENDED_BY_ADMIN' | 'SPEND_DENY_REASON_APP_SUSPENDED' | 'SPEND_DENY_REASON_APP_PAUSED_BY_YOU' | 'SPEND_DENY_REASON_NO_SUPPLY': Reason the calls were denied.
    - `requestTaskId` string: ID of the access request task associated with this episode.
    - `requestTaskState` 'TASK_STATE_UNSPECIFIED' | 'TASK_STATE_OPEN' | 'TASK_STATE_CLOSED': Current state of the associated access request task.
    - `scopeAppId` string: Application ID for application-scoped episodes.
    - `scopeKind` 'SPEND_SCOPE_KIND_UNSPECIFIED' | 'SPEND_SCOPE_KIND_TENANT' | 'SPEND_SCOPE_KIND_SUBJECT' | 'SPEND_SCOPE_KIND_APP' | 'SPEND_SCOPE_KIND_SUBJECT_APP': Budget scope that denied the calls.
    - `scopeUserId` string: User ID for user-scoped episodes.
    - `state` 'SPEND_BLOCK_STATE_UNSPECIFIED' | 'SPEND_BLOCK_STATE_OPEN' | 'SPEND_BLOCK_STATE_CLOSED': Whether this denial episode remains open.
  - `nextPageToken` string: Token for the next page. Empty when no more episodes remain.

## Changes

- **2026-10-20** `fe943bedf41b`: 5 breaking, 14 warning, 19 info
  - removed the enum value `SPEND_BLOCK_SCOPE_KIND_APP` of the request property `filters/oneOf[subschema #1: Denial Filters]/scopeKind`
  - removed the enum value `SPEND_BLOCK_SCOPE_KIND_SUBJECT` of the request property `filters/oneOf[subschema #1: Denial Filters]/scopeKind`
  - removed the enum value `SPEND_BLOCK_SCOPE_KIND_SUBJECT_APP` of the request property `filters/oneOf[subschema #1: Denial Filters]/scopeKind`
  - removed the enum value `SPEND_BLOCK_SCOPE_KIND_TENANT` of the request property `filters/oneOf[subschema #1: Denial Filters]/scopeKind`
  - …34 more
- **2026-10-06** `918a4e749f56`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/conductorone/apis/c1-api/changes/api/v1/spend-insights/denials/search/post.md)

---

[API](https://skmtc.dev/conductorone/apis/c1-api.md) - [All operations](https://skmtc.dev/conductorone/apis/c1-api/llms.txt) - [OpenAPI document](https://skmtc.dev/conductorone/apis/c1-api/revisions/fe943bedf41b?raw)