---
title: "Search App Resources"
method: POST
path: "/api/v1/search/app_resources"
tags: ["App Resource"]
---

# Search App Resources

`POST /api/v1/search/app_resources`

Search app resources based on filters specified in the request body.

## Request body

- C1ApiAppV1SearchAppResourcesRequest — Search app resources based on filters specified in the request body.
  - `appId` string — The app ID to restrict the search to.
  - `appUserIds` string[], nullable — A list of app user IDs to restrict the search by.
  - `excludeDeletedResourceBindings` boolean — If true, exclude resources whose bindings have been deleted.
  - `excludeResourceIds` string[], nullable — A list of resource IDs to exclude from the search results.
  - `excludeResourceTypeTraitIds` string[], nullable — A list of resource type trait IDs to exclude from the search.
  - `ownerUserIds` string[], nullable — A list of C1 user IDs to filter resources by ownership.
  - `pageSize` integer — The maximum number of results to return per page.
  - `pageToken` string — The token for fetching the next page of results.
  - `query` string — Fuzzy search the display name of resources.
  - `refs` C1ApiAppV1AppResourceRef[], nullable — A list of specific app resource references to restrict the search to.
    - `appId` string — The ID of the app that owns the resource.
    - `appResourceTypeId` string — The ID of the resource type that classifies this resource.
    - `id` string — The unique ID of the app resource.
  - `resourceIds` string[], nullable — A list of resource IDs to restrict the search to.
  - `resourceTypeIds` string[], nullable — A list of resource type IDs to restrict the search by.
  - `resourceTypeTraitIds` string[], nullable — A list of resource type trait IDs to restrict the search by.

## Response `200`

The SearchAppResourcesResponse message contains a list of results and a nextPageToken if applicable.

- C1ApiAppV1SearchAppResourcesResponse — The SearchAppResourcesResponse message contains a list of results and a nextPageToken if applicable.
  - `expanded` object[], nullable — List of serialized related objects.
    - `@type` string — The type of the serialized message.
  - `list` C1ApiAppV1AppResourceView[], nullable — The list of app resource results.
    - `appPath` string — JSONPATH expression indicating the location of the App object in the array
    - `appResource` C1ApiAppV1AppResource — The app resource message is a single resource that can have entitlements. This message contains a oneof named metadata. Only a single field of the following list may be set at a time: - secretTrait
      - `accessConfigId` string — The access config ID for this resource. May be empty. Must be one of the builtin access config IDs or empty.
      - `appId` string — The app that this resource belongs to.
      - `appResourceTypeId` string — The resource type that this resource is.
      - `createdAt` string, date-time
      - `customDescription` string — A custom description that can be set for a resource.
      - `deletedAt` string, date-time
      - `description` string — The description set for the resource.
      - `displayName` string — The display name for this resource.
      - `externalId` string — The upstream product's native external ID for this resource (e.g. an Okta group ID). Populated from the connector's external ID during sync.
      - `grantCount` string, int64 — The number of grants to this resource.
      - `id` string — The id of the resource.
      - `matchBatonId` string — The matchBatonId field.
      - `parentAppResourceId` string — The parent resource id, if this resource is a child of another resource.
      - `parentAppResourceTypeId` string — The parent resource type id, if this resource is a child of another resource.
      - `profile` object
      - `secretTrait` C1ApiAppV1SecretTrait, nullable — The SecretTrait message.
        - `identityAppUserId` string — The identityAppUserId field.
        - `lastUsedAt` string, date-time
        - `secretCreatedAt` string, date-time
        - `secretExpiresAt` string, date-time
      - `updatedAt` string, date-time
    - `objectPermissions` C1ApiIamV1ActorObjectPermissions — The ActorObjectPermissions message.
      - `delete` boolean — The delete field.
      - `edit` boolean — The edit field.
      - `extra` object — The extra field.
      - `read` boolean — The read field.
    - `parentResourcePath` string — JSONPATH expression indicating the location of the Parent Resource object in the array
    - `parentResourceTypePath` string — JSONPATH expression indicating the location of the Parent Resource Type object in the array
    - `resourceTypePath` string — JSONPATH expression indicating the location of the Resource Type object in the array
  - `nextPageToken` string — The token for fetching the next page of results.

## Changes

- **2026-04-30** `fa2bb307d6fa` — 1 info
  - added the optional property `list/items/appResource/externalId` to the response with the `200` status
- **2026-02-05** `417c5bf9b0a2` — 4 info
  - added the new optional request property `ownerUserIds`
  - added the optional property `list/items/appResource/accessConfigId` to the response with the `200` status
  - added the optional property `list/items/appResource/profile` to the response with the `200` status
  - added the optional property `list/items/objectPermissions` to the response with the `200` status
- **2025-05-30** `d5c56e8615fe` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/conductorone/apis/c1-api/changes/api/v1/search/app_resources/post.md)

---

[API](https://skmtc.dev/conductorone/apis/c1-api.md) · [All operations](https://skmtc.dev/conductorone/apis/c1-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/conductorone/c1-api/revisions/fa2bb307d6fa/schema)