Search Graph

SearchGraph performs a server-side BFS traversal and returns a bounded, filtered subgraph. Exactly one of user_id, app_id, or resource_id must be set.

POST /api/v1/search/graph

SearchGraph

Go

package main

import(
	"context"
	"github.com/conductorone/conductorone-sdk-go/pkg/models/shared"
	conductoronesdkgo "github.com/conductorone/conductorone-sdk-go"
	"log"
)

func main() {
    ctx := context.Background()

    s := conductoronesdkgo.New(
        conductoronesdkgo.WithSecurity(shared.Security{
            BearerAuth: "<YOUR_BEARER_TOKEN_HERE>",
            Oauth: "<YOUR_OAUTH_HERE>",
        }),
    )

    res, err := s.AppEntitlementSearch.SearchGraph(ctx, nil)
    if err != nil {
        log.Fatal(err)
    }
    if res.AppEntitlementSearchServiceSearchGraphResponse != nil {
        // handle response
    }
}

import { ConductoroneSDKTypescript } from "conductorone-sdk-typescript";

const conductoroneSDKTypescript = new ConductoroneSDKTypescript({
  security: {
    bearerAuth: "<YOUR_BEARER_TOKEN_HERE>",
    oauth: "<YOUR_OAUTH_HERE>",
  },
});

async function run() {
  const result = await conductoroneSDKTypescript.appEntitlementSearch.searchGraph();

  console.log(result);
}

run();

curl --request POST \
  --url https://{tenantDomain}.conductor.one/api/v1/search/graph \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "appId": "<string>",
  "appIds": [
    "<string>"
  ],
  "entitlementIds": [
    "<string>"
  ],
  "entitlementNameQuery": "<string>",
  "maxDepth": 123,
  "maxFanOut": 123,
  "maxNodes": 123,
  "pageSize": 123,
  "pageToken": "<string>",
  "resourceId": "<string>",
  "resourceIds": [
    "<string>"
  ],
  "resourceNameQuery": "<string>",
  "resourceTypeIds": [
    "<string>"
  ],
  "userId": "<string>"
}
'

import requests

url = "https://{tenantDomain}.conductor.one/api/v1/search/graph"

payload = {
    "appId": "<string>",
    "appIds": ["<string>"],
    "entitlementIds": ["<string>"],
    "entitlementNameQuery": "<string>",
    "maxDepth": 123,
    "maxFanOut": 123,
    "maxNodes": 123,
    "pageSize": 123,
    "pageToken": "<string>",
    "resourceId": "<string>",
    "resourceIds": ["<string>"],
    "resourceNameQuery": "<string>",
    "resourceTypeIds": ["<string>"],
    "userId": "<string>"
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    appId: '<string>',
    appIds: ['<string>'],
    entitlementIds: ['<string>'],
    entitlementNameQuery: '<string>',
    maxDepth: 123,
    maxFanOut: 123,
    maxNodes: 123,
    pageSize: 123,
    pageToken: '<string>',
    resourceId: '<string>',
    resourceIds: ['<string>'],
    resourceNameQuery: '<string>',
    resourceTypeIds: ['<string>'],
    userId: '<string>'
  })
};

fetch('https://{tenantDomain}.conductor.one/api/v1/search/graph', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://{tenantDomain}.conductor.one/api/v1/search/graph",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'appId' => '<string>',
    'appIds' => [
        '<string>'
    ],
    'entitlementIds' => [
        '<string>'
    ],
    'entitlementNameQuery' => '<string>',
    'maxDepth' => 123,
    'maxFanOut' => 123,
    'maxNodes' => 123,
    'pageSize' => 123,
    'pageToken' => '<string>',
    'resourceId' => '<string>',
    'resourceIds' => [
        '<string>'
    ],
    'resourceNameQuery' => '<string>',
    'resourceTypeIds' => [
        '<string>'
    ],
    'userId' => '<string>'
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

HttpResponse<String> response = Unirest.post("https://{tenantDomain}.conductor.one/api/v1/search/graph")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"appId\": \"<string>\",\n  \"appIds\": [\n    \"<string>\"\n  ],\n  \"entitlementIds\": [\n    \"<string>\"\n  ],\n  \"entitlementNameQuery\": \"<string>\",\n  \"maxDepth\": 123,\n  \"maxFanOut\": 123,\n  \"maxNodes\": 123,\n  \"pageSize\": 123,\n  \"pageToken\": \"<string>\",\n  \"resourceId\": \"<string>\",\n  \"resourceIds\": [\n    \"<string>\"\n  ],\n  \"resourceNameQuery\": \"<string>\",\n  \"resourceTypeIds\": [\n    \"<string>\"\n  ],\n  \"userId\": \"<string>\"\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://{tenantDomain}.conductor.one/api/v1/search/graph")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"appId\": \"<string>\",\n  \"appIds\": [\n    \"<string>\"\n  ],\n  \"entitlementIds\": [\n    \"<string>\"\n  ],\n  \"entitlementNameQuery\": \"<string>\",\n  \"maxDepth\": 123,\n  \"maxFanOut\": 123,\n  \"maxNodes\": 123,\n  \"pageSize\": 123,\n  \"pageToken\": \"<string>\",\n  \"resourceId\": \"<string>\",\n  \"resourceIds\": [\n    \"<string>\"\n  ],\n  \"resourceNameQuery\": \"<string>\",\n  \"resourceTypeIds\": [\n    \"<string>\"\n  ],\n  \"userId\": \"<string>\"\n}"

response = http.request(request)
puts response.read_body

200

{
  "edges": [
    {
      "hiddenChildren": 123,
      "isTruncated": true,
      "sourceId": "<string>",
      "targetId": "<string>"
    }
  ],
  "hasMore": true,
  "nodeCeilingHit": true,
  "nodes": [
    {
      "appId": "<string>",
      "displayName": "<string>",
      "id": "<string>",
      "resourceTypeId": "<string>",
      "secondaryText": "<string>"
    }
  ],
  "pageToken": "<string>",
  "pathsReturned": 123,
  "truncatedNodeIds": [
    "<string>"
  ]
}

Authorizations

Authorization · string · header · required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Authorization · string · header · required

This API uses OAuth2 with the Client Credential flow. Client Credentials must be sent in the BODY, not the headers. For an example of how to implement this, refer to the c1TokenSource.Token() function.

Body

application/json

SearchGraph request. Builds a filtered access graph starting from a root entity. Exactly one of user_id, app_id, or resource_id must be set. Server validates this constraint and returns InvalidArgument if violated.

appId · string

The appId field.

appIds · string[] | null

Filters — all optional, applied at every traversal hop

entitlementIds · string[] | null

The entitlementIds field.

entitlementNameQuery · string

The entitlementNameQuery field.

maxDepth · integer<int32>

Traversal controls

maxFanOut · integer<int32>

Legacy per-parent fan-out limit. Superseded by max_nodes and server-computed per-parent budgets, but still honored for callers that set it.

maxNodes · integer<int32>

Overall node budget for the returned subgraph. 0 uses the server default.

pageSize · integer<int32>

Legacy traversal page size. Superseded by max_nodes, but still honored for callers that set it.

pageToken · string

Legacy pagination token. Superseded by max_nodes-based traversal, but still honored for callers that set it.

resourceId · string

The resourceId field.

resourceIds · string[] | null

The resourceIds field.

resourceNameQuery · string

The resourceNameQuery field.

resourceTypeIds · string[] | null

The resourceTypeIds field.

userId · string

Root entity — exactly one must be set

Response

200 - application/json

SearchGraph response. Contains a subgraph of nodes and edges.

SearchGraph response. Contains a subgraph of nodes and edges.

edges · Graph Edge · object[] | null

The edges field.

Show child attributes

hasMore · boolean

The hasMore field.

nodeCeilingHit · boolean

True if the server-side node budget stopped the traversal before it finished walking the graph. Distinct from has_more, which can also be set by a request timeout or scan limit.

nodes · Graph Node · object[] | null

The nodes field.

Show child attributes

pageToken · string

The pageToken field.

pathsReturned · integer<int32>

The pathsReturned field.

truncatedNodeIds · string[] | null

The truncatedNodeIds field.