---
title: "Search account resources"
method: GET
path: "/api/v1/me/search"
tags: ["Settings"]
---

# Search account resources

`GET /api/v1/me/search`

## Request

- Base URL: `https://api.proof.holdings`
- URL: `https://api.proof.holdings/api/v1/me/search`
- Auth: one of:
  - HTTP bearer
  - API key in cookie `auth_token`

Global account search for the dashboard Ctrl+K palette and AI agents. Prefix-anchored, case-sensitive match over indexed plaintext fields only (reference IDs, external user IDs, HITL config names, BSUIDs, API-key names) plus status. Recipient identifiers are masked (SEC-001); every result is scoped to the authenticated user, and each bucket requires the matching read scope (JWT sessions have full access).

## Query parameters

- `q` string, required: Search term (min 3 chars). Prefix-anchored, case-sensitive; matched against indexed plaintext fields only.
- `type` 'verification_requests' | 'verifications' | 'hitl' | 'confirmations' | 'authorizations' | 'api_keys': Narrow the search to a single result bucket
- `environment` 'production' | 'test': Scope results to test or production data (a pk_test_* key defaults to test; this overrides)
- `limit` integer: Max results per bucket (default 10)

## Response `200`

Search results grouped by resource type

- MeSearchResponse: Account search results grouped by resource type. `masked_identifier` is always masked; the owner's JWT session additionally receives the unmasked `identifier` twin — never returned to API-key callers (owner-vs-not boundary, SEC-001). The hitl/confirmations buckets require the matching read scope.
  - `data` object, required
    - `verification_requests` object[], required
      - `id` string, required
      - `reference_id` string, nullable, required
      - `status` string, required
      - `created_at` string, required
    - `verifications` object[], required
      - `id` string, required
      - `external_user_id` string, nullable, required
      - `type` string, required
      - `channel` string, required
      - `status` string, required
      - `masked_identifier` string, required: Recipient identifier, masked (SEC-001)
      - `identifier` string, nullable: Unmasked verification identifier — present ONLY for the owner's JWT (dashboard) session, never for API-key callers (owner-vs-not masking boundary, SEC-001)
      - `created_at` string, required
    - `hitl` object[], required
      - `id` string, required
      - `name` string, required
      - `status` string, required
    - `confirmations` object[], required
      - `id` string, required
      - `hitl_id` string, required
      - `config_name` string, nullable, required
      - `status` string, required
      - `timeout_at` string, nullable, required
      - `created_at` string, required
    - `authorizations` object[], required
      - `id` string, required
      - `bsuid` string, nullable, required
      - `channel` string, required
      - `status` string, required
      - `business_name` string, required
      - `created_at` string, required
    - `api_keys` object[], required
      - `id` string, required
      - `name` string, required
      - `key_prefix` string, required
      - `created_at` string, required
  - `total` number, required

## Other responses

- `400`: Validation error (e.g. query shorter than 3 characters)
- `401`: Unauthorized
- `429`: Rate limit exceeded

---

[API](https://skmtc.dev/proof/apis/proof-holdings-api.md) · [All operations](https://skmtc.dev/proof/apis/proof-holdings-api/llms.txt) · [OpenAPI document](https://skmtc.dev/proof/apis/proof-holdings-api/revisions/b15f506de696?raw)