Search Grants

Search grants (user-to-entitlement bindings) across apps, with filters for app, user, resource type, and entitlement.

POST /api/v1/search/grants

SearchGrants

Go

package main

import(
	"context"
	"github.com/conductorone/conductorone-sdk-go/pkg/models/shared"
	conductoronesdkgo "github.com/conductorone/conductorone-sdk-go"
	"log"
)

func main() {
    ctx := context.Background()

    s := conductoronesdkgo.New(
        conductoronesdkgo.WithSecurity(shared.Security{
            BearerAuth: "<YOUR_BEARER_TOKEN_HERE>",
            Oauth: "<YOUR_OAUTH_HERE>",
        }),
    )

    res, err := s.AppEntitlementSearch.SearchGrants(ctx, nil)
    if err != nil {
        log.Fatal(err)
    }
    if res.AppEntitlementSearchServiceSearchGrantsResponse != nil {
        // handle response
    }
}

import { ConductoroneSDKTypescript } from "conductorone-sdk-typescript";

const conductoroneSDKTypescript = new ConductoroneSDKTypescript({
  security: {
    bearerAuth: "<YOUR_BEARER_TOKEN_HERE>",
    oauth: "<YOUR_OAUTH_HERE>",
  },
});

async function run() {
  const result = await conductoroneSDKTypescript.appEntitlementSearch.searchGrants();

  console.log(result);
}

run();

curl --request POST \
  --url https://{tenantDomain}.conductor.one/api/v1/search/grants \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "appIds": [
    "<string>"
  ],
  "appUserIds": [
    "<string>"
  ],
  "entitlementRefs": [
    {
      "appId": "<string>",
      "id": "<string>"
    }
  ],
  "entitlementSlugs": [
    "<string>"
  ],
  "expandMask": {
    "paths": [
      "<string>"
    ]
  },
  "pageSize": 123,
  "pageToken": "<string>",
  "purpose": [],
  "resourceIds": [
    "<string>"
  ],
  "resourceTypeIds": [
    "<string>"
  ],
  "userId": "<string>"
}
'

import requests

url = "https://{tenantDomain}.conductor.one/api/v1/search/grants"

payload = {
    "appIds": ["<string>"],
    "appUserIds": ["<string>"],
    "entitlementRefs": [
        {
            "appId": "<string>",
            "id": "<string>"
        }
    ],
    "entitlementSlugs": ["<string>"],
    "expandMask": { "paths": ["<string>"] },
    "pageSize": 123,
    "pageToken": "<string>",
    "purpose": [],
    "resourceIds": ["<string>"],
    "resourceTypeIds": ["<string>"],
    "userId": "<string>"
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    appIds: ['<string>'],
    appUserIds: ['<string>'],
    entitlementRefs: [{appId: '<string>', id: '<string>'}],
    entitlementSlugs: ['<string>'],
    expandMask: {paths: ['<string>']},
    pageSize: 123,
    pageToken: '<string>',
    purpose: [],
    resourceIds: ['<string>'],
    resourceTypeIds: ['<string>'],
    userId: '<string>'
  })
};

fetch('https://{tenantDomain}.conductor.one/api/v1/search/grants', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://{tenantDomain}.conductor.one/api/v1/search/grants",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'appIds' => [
        '<string>'
    ],
    'appUserIds' => [
        '<string>'
    ],
    'entitlementRefs' => [
        [
                'appId' => '<string>',
                'id' => '<string>'
        ]
    ],
    'entitlementSlugs' => [
        '<string>'
    ],
    'expandMask' => [
        'paths' => [
                '<string>'
        ]
    ],
    'pageSize' => 123,
    'pageToken' => '<string>',
    'purpose' => [
        
    ],
    'resourceIds' => [
        '<string>'
    ],
    'resourceTypeIds' => [
        '<string>'
    ],
    'userId' => '<string>'
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

HttpResponse<String> response = Unirest.post("https://{tenantDomain}.conductor.one/api/v1/search/grants")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"appIds\": [\n    \"<string>\"\n  ],\n  \"appUserIds\": [\n    \"<string>\"\n  ],\n  \"entitlementRefs\": [\n    {\n      \"appId\": \"<string>\",\n      \"id\": \"<string>\"\n    }\n  ],\n  \"entitlementSlugs\": [\n    \"<string>\"\n  ],\n  \"expandMask\": {\n    \"paths\": [\n      \"<string>\"\n    ]\n  },\n  \"pageSize\": 123,\n  \"pageToken\": \"<string>\",\n  \"purpose\": [],\n  \"resourceIds\": [\n    \"<string>\"\n  ],\n  \"resourceTypeIds\": [\n    \"<string>\"\n  ],\n  \"userId\": \"<string>\"\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://{tenantDomain}.conductor.one/api/v1/search/grants")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"appIds\": [\n    \"<string>\"\n  ],\n  \"appUserIds\": [\n    \"<string>\"\n  ],\n  \"entitlementRefs\": [\n    {\n      \"appId\": \"<string>\",\n      \"id\": \"<string>\"\n    }\n  ],\n  \"entitlementSlugs\": [\n    \"<string>\"\n  ],\n  \"expandMask\": {\n    \"paths\": [\n      \"<string>\"\n    ]\n  },\n  \"pageSize\": 123,\n  \"pageToken\": \"<string>\",\n  \"purpose\": [],\n  \"resourceIds\": [\n    \"<string>\"\n  ],\n  \"resourceTypeIds\": [\n    \"<string>\"\n  ],\n  \"userId\": \"<string>\"\n}"

response = http.request(request)
puts response.read_body

200

{
  "expanded": [
    {
      "@type": "<string>"
    }
  ],
  "list": [
    {
      "appEntitlementUserBinding": {
        "appEntitlementUserBindingCreatedAt": "2023-11-07T05:31:56Z",
        "appEntitlementUserBindingDeprovisionAt": "2023-11-07T05:31:56Z",
        "appUser": {
          "appPath": "<string>",
          "appUser": {
            "appId": "<string>",
            "createdAt": "2023-11-07T05:31:56Z",
            "deletedAt": "2023-11-07T05:31:56Z",
            "displayName": "<string>",
            "email": "<string>",
            "emails": [
              "<string>"
            ],
            "employeeIds": [
              "<string>"
            ],
            "id": "<string>",
            "identityUserId": "<string>",
            "isExternal": true,
            "profile": {},
            "status": {
              "details": "<string>"
            },
            "updatedAt": "2023-11-07T05:31:56Z",
            "username": "<string>",
            "usernames": [
              "<string>"
            ]
          },
          "identityUserPath": "<string>",
          "lastUsagePath": "<string>"
        },
        "grantSources": [
          {
            "appId": "<string>",
            "id": "<string>"
          }
        ],
        "originatingTicketId": "<string>"
      },
      "entitlement": {
        "appEntitlement": {
          "alias": "<string>",
          "annotations": {},
          "appId": "<string>",
          "appResourceId": "<string>",
          "appResourceTypeId": "<string>",
          "certifyPolicyId": "<string>",
          "complianceFrameworkValueIds": [
            "<string>"
          ],
          "createdAt": "2023-11-07T05:31:56Z",
          "defaultValuesApplied": true,
          "deletedAt": "2023-11-07T05:31:56Z",
          "deprovisionerPolicy": {
            "action": {
              "actionName": "<string>",
              "appId": "<string>",
              "connectorId": "<string>",
              "displayName": "<string>"
            },
            "connector": {
              "account": {
                "config": {},
                "connectorId": "<string>",
                "doNotSave": {},
                "saveToVault": {
                  "vaultIds": [
                    "<string>"
                  ]
                },
                "schemaId": "<string>"
              },
              "defaultBehavior": {
                "connectorId": "<string>"
              },
              "deleteAccount": {
                "connectorId": "<string>"
              }
            },
            "delegated": {
              "appId": "<string>",
              "entitlementId": "<string>",
              "implicit": true
            },
            "externalTicket": {
              "appId": "<string>",
              "connectorId": "<string>",
              "externalTicketProvisionerConfigId": "<string>",
              "instructions": "<string>"
            },
            "manual": {
              "assignee": {
                "appOwners": {
                  "allowReassignment": true,
                  "fallbackUserIds": [
                    "<string>"
                  ]
                },
                "entitlementOwners": {
                  "allowReassignment": true,
                  "fallbackUserIds": [
                    "<string>"
                  ]
                },
                "expression": {
                  "allowReassignment": true,
                  "expressions": [
                    "<string>"
                  ],
                  "fallbackUserIds": [
                    "<string>"
                  ]
                },
                "group": {
                  "allowReassignment": true,
                  "appGroupId": "<string>",
                  "appId": "<string>",
                  "fallbackUserIds": [
                    "<string>"
                  ]
                },
                "manager": {
                  "allowReassignment": true,
                  "fallbackUserIds": [
                    "<string>"
                  ]
                },
                "users": {
                  "allowReassignment": true,
                  "userIds": [
                    "<string>"
                  ]
                }
              },
              "instructions": "<string>",
              "userIds": [
                "<string>"
              ]
            },
            "multiStep": {
              "provisionSteps": "<array>"
            },
            "unconfigured": {},
            "webhook": {
              "webhookId": "<string>"
            }
          },
          "description": "<string>",
          "displayName": "<string>",
          "durationGrant": "<string>",
          "durationUnset": {},
          "emergencyGrantEnabled": true,
          "emergencyGrantPolicyId": "<string>",
          "externalId": "<string>",
          "grantCount": "<string>",
          "grantPolicyId": "<string>",
          "id": "<string>",
          "isAutomationEnabled": true,
          "isManuallyManaged": true,
          "matchBatonId": "<string>",
          "overrideAccessRequestsDefaults": true,
          "provisionerPolicy": {
            "action": {
              "actionName": "<string>",
              "appId": "<string>",
              "connectorId": "<string>",
              "displayName": "<string>"
            },
            "connector": {
              "account": {
                "config": {},
                "connectorId": "<string>",
                "doNotSave": {},
                "saveToVault": {
                  "vaultIds": [
                    "<string>"
                  ]
                },
                "schemaId": "<string>"
              },
              "defaultBehavior": {
                "connectorId": "<string>"
              },
              "deleteAccount": {
                "connectorId": "<string>"
              }
            },
            "delegated": {
              "appId": "<string>",
              "entitlementId": "<string>",
              "implicit": true
            },
            "externalTicket": {
              "appId": "<string>",
              "connectorId": "<string>",
              "externalTicketProvisionerConfigId": "<string>",
              "instructions": "<string>"
            },
            "manual": {
              "assignee": {
                "appOwners": {
                  "allowReassignment": true,
                  "fallbackUserIds": [
                    "<string>"
                  ]
                },
                "entitlementOwners": {
                  "allowReassignment": true,
                  "fallbackUserIds": [
                    "<string>"
                  ]
                },
                "expression": {
                  "allowReassignment": true,
                  "expressions": [
                    "<string>"
                  ],
                  "fallbackUserIds": [
                    "<string>"
                  ]
                },
                "group": {
                  "allowReassignment": true,
                  "appGroupId": "<string>",
                  "appId": "<string>",
                  "fallbackUserIds": [
                    "<string>"
                  ]
                },
                "manager": {
                  "allowReassignment": true,
                  "fallbackUserIds": [
                    "<string>"
                  ]
                },
                "users": {
                  "allowReassignment": true,
                  "userIds": [
                    "<string>"
                  ]
                }
              },
              "instructions": "<string>",
              "userIds": [
                "<string>"
              ]
            },
            "multiStep": {
              "provisionSteps": "<array>"
            },
            "unconfigured": {},
            "webhook": {
              "webhookId": "<string>"
            }
          },
          "requestSchemaId": "<string>",
          "revokePolicyId": "<string>",
          "riskLevelValueId": "<string>",
          "slug": "<string>",
          "sourceConnectorIds": {},
          "systemBuiltin": true,
          "updatedAt": "2023-11-07T05:31:56Z",
          "userEditedMask": "<string>"
        },
        "appPath": "<string>",
        "appResourcePath": "<string>",
        "appResourceTypePath": "<string>",
        "objectPermissions": {
          "delete": true,
          "edit": true,
          "extra": {},
          "read": true
        }
      }
    }
  ],
  "nextPageToken": "<string>"
}

Authorizations

Authorization · string · header · required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Authorization · string · header · required

This API uses OAuth2 with the Client Credential flow. Client Credentials must be sent in the BODY, not the headers. For an example of how to implement this, refer to the c1TokenSource.Token() function.

Body

application/json

The AppEntitlementSearchServiceSearchGrantsRequest message.

appIds · string[] | null

Search for grants contained in any of these apps.

appUserIds · string[] | null

Search for grants that are granted to any of these app user ids.

entitlementRefs · App Entitlement Ref · object[] | null

Search for grants of an entitlement

Show child attributes

entitlementSlugs · string[] | null

Filter for entitlements whose slug is in this list (e.g. "enrollment" for access profiles)

expandMask · App Entitlement Expand Mask · object | null

The app entitlement expand mask allows the user to get additional information when getting responses containing app entitlement views.

Show child attributes

pageSize · integer<int32> | null

The pageSize where 0 <= pageSize <= 100. Values < 10 will be set to 10. A value of 0 returns the default page size (currently 25)

pageToken · string | null

The pageToken field.

purpose · enum<string>[] | null

Filter for entitlements with these purposes (e.g., ASSIGNMENT for membership entitlements)

Available options: APP_ENTITLEMENT_PURPOSE_VALUE_UNSPECIFIED, APP_ENTITLEMENT_PURPOSE_VALUE_ASSIGNMENT, APP_ENTITLEMENT_PURPOSE_VALUE_PERMISSION, APP_ENTITLEMENT_PURPOSE_VALUE_OWNERSHIP

resourceIds · string[] | null

Search for grants within a resource.

resourceTypeIds · string[] | null

Search grants for given resource types.

userId · string | null

Search for grants of a user

Response

200 - application/json

Successful response

The AppEntitlementSearchServiceSearchGrantsResponse message.

expanded · object[] | null

The expanded field.

Show child attributes

list · App Entitlement With User Binding · object[] | null

The list field.

Show child attributes

nextPageToken · string | null

The nextPageToken field.