# C1 documentation: API Endpoints ## Endpoints - [API / Endpoints / Access Review (12 pages)](https://www.c1.ai/docs/_llms/api/endpoints/access-review.md): Documentation for API / Endpoints / Access Review. - [API / Endpoints / Connector (17 pages)](https://www.c1.ai/docs/_llms/api/endpoints/connector.md): Documentation for API / Endpoints / Connector. - [API / Endpoints / MCP Toolsets (15 pages)](https://www.c1.ai/docs/_llms/api/endpoints/mcp-toolsets.md): Documentation for API / Endpoints / MCP Toolsets. - [API / Endpoints / Edge (32 pages)](https://www.c1.ai/docs/_llms/api/endpoints/edge.md): Documentation for API / Endpoints / Edge. - [API / Endpoints / App Entitlement (17 pages)](https://www.c1.ai/docs/_llms/api/endpoints/app-entitlement.md): Documentation for API / Endpoints / App Entitlement. - [API / Endpoints / Session Policy (15 pages)](https://www.c1.ai/docs/_llms/api/endpoints/session-policy.md): Documentation for API / Endpoints / Session Policy. - [API / Endpoints / MCP Servers (13 pages)](https://www.c1.ai/docs/_llms/api/endpoints/mcp-servers.md): Documentation for API / Endpoints / MCP Servers. - [API / Endpoints / SSO (18 pages)](https://www.c1.ai/docs/_llms/api/endpoints/sso.md): Documentation for API / Endpoints / SSO. - [API / Endpoints / Cross-App Access (36 pages)](https://www.c1.ai/docs/_llms/api/endpoints/cross-app-access.md): Documentation for API / Endpoints / Cross-App Access. - [API / Endpoints / Automations (15 pages)](https://www.c1.ai/docs/_llms/api/endpoints/automations.md): Documentation for API / Endpoints / Automations. - [API / Endpoints / Request Catalog (25 pages)](https://www.c1.ai/docs/_llms/api/endpoints/request-catalog.md): Documentation for API / Endpoints / Request Catalog. - [API / Endpoints / Subject App Limits (7 pages)](https://www.c1.ai/docs/_llms/api/endpoints/subject-app-limits.md): Documentation for API / Endpoints / Subject App Limits. - [API / Endpoints / Report (8 pages)](https://www.c1.ai/docs/_llms/api/endpoints/report.md): Documentation for API / Endpoints / Report. - [API / Endpoints / Role Mining (19 pages)](https://www.c1.ai/docs/_llms/api/endpoints/role-mining.md): Documentation for API / Endpoints / Role Mining. - [API / Endpoints / Virtual MCP Servers (12 pages)](https://www.c1.ai/docs/_llms/api/endpoints/virtual-mcp-servers.md): Documentation for API / Endpoints / Virtual MCP Servers. - [API / Endpoints / Secrets (10 pages)](https://www.c1.ai/docs/_llms/api/endpoints/secrets.md): Documentation for API / Endpoints / Secrets. - [API / Endpoints / Task (24 pages)](https://www.c1.ai/docs/_llms/api/endpoints/task.md): Documentation for API / Endpoints / Task. - [API / Endpoints / Workload Federation (13 pages)](https://www.c1.ai/docs/_llms/api/endpoints/workload-federation.md): Documentation for API / Endpoints / Workload Federation. ### A 2 UI - [List Surfaces](https://www.c1.ai/docs/api-reference/a-2-ui/list-surfaces.md): ListSurfaces returns active surfaces for a conversation. - [Get Surface Provenance](https://www.c1.ai/docs/api-reference/a-2-ui/get-surface-provenance.md): GetSurfaceProvenance returns, in plain terms, what the surface's report was built from: every record its program touched, in the order it touched them. - [Submit Action](https://www.c1.ai/docs/api-reference/a-2-ui/submit-action.md): SubmitAction handles user actions on A2UI surfaces. - [List Surface Feedback](https://www.c1.ai/docs/api-reference/a-2-ui/list-surface-feedback.md): ListSurfaceFeedback lists feedback for a surface. - [Create Surface Feedback](https://www.c1.ai/docs/api-reference/a-2-ui/create-surface-feedback.md): CreateSurfaceFeedback submits feedback for a surface with a snapshot. ### Access Review Template - [Create](https://www.c1.ai/docs/api-reference/access-review-template/create.md): Create creates a new access review template that defines a reusable configuration for launching campaigns. - [Get](https://www.c1.ai/docs/api-reference/access-review-template/get.md): Get retrieves a single access review template by ID. - [Update](https://www.c1.ai/docs/api-reference/access-review-template/update.md): Update modifies an existing access review template. Use the update_mask to specify which fields to change. - [Delete](https://www.c1.ai/docs/api-reference/access-review-template/delete.md): Delete an access review template. The template can no longer be used to create campaigns. ### Access Review Templates - [Add Template Entitlements](https://www.c1.ai/docs/api-reference/access-review-templates/add-template-entitlements.md): AddTemplateEntitlements adds entitlements to an access review template's selection without replacing existing selections or their policies. For large selections, send chunks of at most 200 entitlements and wait for each call to finish before sending the next. Entitlements that are already selecte… - [Remove Template Entitlements](https://www.c1.ai/docs/api-reference/access-review-templates/remove-template-entitlements.md): RemoveTemplateEntitlements removes entitlements from an access review template's selection without changing other selections or their policies. Entitlements that are not selected are ignored, so retrying a chunk is safe. Send at most 200 entitlements per call. - [Get Scope And Entitlements](https://www.c1.ai/docs/api-reference/access-review-templates/get-scope-and-entitlements.md): GetScopeAndEntitlements retrieves the current scope configuration and selected entitlements for an access review template. - [Set Scope And Entitlements](https://www.c1.ai/docs/api-reference/access-review-templates/set-scope-and-entitlements.md): SetScopeAndEntitlements replaces the scope configuration and selected entitlements for an access review template. Each call replaces the whole selection. To build a large selection, use AddTemplateEntitlements in chunks instead. - [Set Scope By Resource Type](https://www.c1.ai/docs/api-reference/access-review-templates/set-scope-by-resource-type.md): SetScopeByResourceType sets the template scope by selecting specific resource types to include in campaigns created from this template. ### Access Conflict - [Create Monitor](https://www.c1.ai/docs/api-reference/access-conflict/create-monitor.md): Create a new conflict monitor for defining a Separation of Duty rule. Entitlement sets are bound separately via AppEntitlementMonitorBindingService. - [Get Monitor](https://www.c1.ai/docs/api-reference/access-conflict/get-monitor.md): Retrieve a single conflict monitor by ID. - [Update Monitor](https://www.c1.ai/docs/api-reference/access-conflict/update-monitor.md): Update the display name, description, or notification settings of a conflict monitor. - [Delete Monitor](https://www.c1.ai/docs/api-reference/access-conflict/delete-monitor.md): Delete a conflict monitor and its associated entitlement set bindings. ### App Secrets Admin - [Revoke](https://www.c1.ai/docs/api-reference/app-secrets-admin/revoke.md): Revoke queues one provider-side revoke for one vended credential. ### AppUsers - [List Owned Service Accounts](https://www.c1.ai/docs/api-reference/appusers/list-owned-service-accounts.md): ListOwnedServiceAccounts returns the service accounts owned by the calling user. The owner is the authenticated caller; it is not accepted as an input. - [List](https://www.c1.ai/docs/api-reference/appusers/list.md): List app user accounts within a specific app, with pagination support. - [List App User Credentials](https://www.c1.ai/docs/api-reference/appusers/list-app-user-credentials.md): List credentials associated with a specific app user account. - [List App Users For User](https://www.c1.ai/docs/api-reference/appusers/list-app-users-for-user.md): List app user accounts within a specific app that are correlated to a given C1 user. - [Update](https://www.c1.ai/docs/api-reference/appusers/update.md): Update an app user by ID. Only the fields specified in the update mask are updated. Currently, only the appUserType, and identityUserId fields can be updated. - [Search](https://www.c1.ai/docs/api-reference/appusers/search.md): Search app users based on filters specified in the request body. ### App Entitlement Monitor Binding - [Create App Entitlement Monitor Binding](https://www.c1.ai/docs/api-reference/app-entitlement-monitor-binding/create-app-entitlement-monitor-binding.md): Bind an app entitlement to one side (A or B) of a conflict monitor. - [Delete App Entitlement Monitor Binding](https://www.c1.ai/docs/api-reference/app-entitlement-monitor-binding/delete-app-entitlement-monitor-binding.md): Remove an app entitlement from a conflict monitor's entitlement set. - [Get App Entitlement Monitor Binding](https://www.c1.ai/docs/api-reference/app-entitlement-monitor-binding/get-app-entitlement-monitor-binding.md): Retrieve a single binding that associates an app entitlement with one side of a conflict monitor. ### App - [List](https://www.c1.ai/docs/api-reference/app/list.md): List all apps. - [Create](https://www.c1.ai/docs/api-reference/app/create.md): Create a new manual app without a connector. - [Get](https://www.c1.ai/docs/api-reference/app/get.md): Get an app by ID. - [Update](https://www.c1.ai/docs/api-reference/app/update.md): Update an existing app. - [Delete](https://www.c1.ai/docs/api-reference/app/delete.md): Delete an app. - [Search](https://www.c1.ai/docs/api-reference/app/search.md): Search apps based on filters specified in the request body. - [Search User Ownership](https://www.c1.ai/docs/api-reference/app/search-user-ownership.md): Search all ownership assignments for a given user across apps, resources, and entitlements. ### AppAccessRequestDefaults - [Get App Access Requests Defaults](https://www.c1.ai/docs/api-reference/appaccessrequestdefaults/get-app-access-requests-defaults.md): Retrieve the current access request default settings for an app. - [Create App Access Requests Defaults](https://www.c1.ai/docs/api-reference/appaccessrequestdefaults/create-app-access-requests-defaults.md): Create or replace the access request default settings for an app. - [Cancel App Access Requests Defaults](https://www.c1.ai/docs/api-reference/appaccessrequestdefaults/cancel-app-access-requests-defaults.md): Cancel an in-progress apply operation for the app's access request defaults. ### AuthZEN Policies - [List Authzen Policies](https://www.c1.ai/docs/api-reference/authzen-policies/list-authzen-policies.md): ListAuthzenPolicies returns an app's CEL policy revisions, newest first. - [Create Authzen Policy](https://www.c1.ai/docs/api-reference/authzen-policies/create-authzen-policy.md): CreateAuthzenPolicy validates the CEL syntax (requiring a bool result) and stores a new, immutable policy revision for the app. The revision has no effect until a server's active_policy_id is set to it via Update. - [Get Authzen Policy](https://www.c1.ai/docs/api-reference/authzen-policies/get-authzen-policy.md): GetAuthzenPolicy retrieves one CEL policy revision by ID. - [Delete Authzen Policy](https://www.c1.ai/docs/api-reference/authzen-policies/delete-authzen-policy.md): DeleteAuthzenPolicy deletes a CEL policy revision. Refused while any of the app's AuthZEN servers has the policy active. - [Test Authzen Policy](https://www.c1.ai/docs/api-reference/authzen-policies/test-authzen-policy.md): TestAuthzenPolicy evaluates a stored or inline CEL policy against a live request tuple and returns the decision and the variables it saw, without requiring the policy to be activated on any server. ### AuthZEN Servers - [List](https://www.c1.ai/docs/api-reference/authzen-servers/list.md): List retrieves AuthZEN servers for an app. - [Create](https://www.c1.ai/docs/api-reference/authzen-servers/create.md): Create mints an AuthZEN server (and its evaluate/search entitlements) for an app. The server starts disabled. - [Get](https://www.c1.ai/docs/api-reference/authzen-servers/get.md): Get retrieves one AuthZEN server. - [Update](https://www.c1.ai/docs/api-reference/authzen-servers/update.md): Update edits a server's mode via update_mask. - [Delete](https://www.c1.ai/docs/api-reference/authzen-servers/delete.md): Delete soft-deletes an AuthZEN server and cascades its minted entitlement stack. Evaluation and search 404 immediately; discovery is static URL templating and deliberately never reads the database, so it keeps answering for any well-formed path. ### MCP Resources - [List](https://www.c1.ai/docs/api-reference/mcp-resources/list.md): List returns the MCP resources discovered for a single (app_id, connector_id), paginated. To filter by kind or state, use Search. - [Get](https://www.c1.ai/docs/api-reference/mcp-resources/get.md): Get retrieves a single discovered MCP resource by app_id + connector_id + id, including its approval state, kind, URI or URI template, and bound app_entitlement_id. - [Update](https://www.c1.ai/docs/api-reference/mcp-resources/update.md): Update modifies a resource's lifecycle state via update_mask. Set resource.state = MCP_RESOURCE_STATE_APPROVED with update_mask "state" to move it out of PENDING_REVIEW (or DISABLED to block it). Resource metadata is discovery-owned and read-only. resource must include id, app_id, and connector_… - [List History](https://www.c1.ai/docs/api-reference/mcp-resources/list-history.md): ListHistory returns the change history (newest first) for a single MCP resource — each entry is a snapshot plus who/when metadata. - [Search](https://www.c1.ai/docs/api-reference/mcp-resources/search.md): Search returns a connector's MCP resources filtered by kind, state, or text query. Filter on MCP_RESOURCE_STATE_PENDING_REVIEW to find resources awaiting approval, then approve them with Update. ### MCP Tools - [List](https://www.c1.ai/docs/api-reference/mcp-tools/list.md): List returns the MCP tools discovered for a single (app_id, connector_id), paginated. To filter by state, classification, or visibility, use Search. - [Get](https://www.c1.ai/docs/api-reference/mcp-tools/get.md): Get retrieves a single discovered MCP tool by app_id + connector_id + id, including its approval state, classification, visibility, input schema, and bound app_entitlement_id. - [Update](https://www.c1.ai/docs/api-reference/mcp-tools/update.md): Update modifies an MCP tool's admin-editable fields via update_mask. This is how a tool is approved: set tool.state = MCP_TOOL_STATE_APPROVED with update_mask "state" to move it out of PENDING_REVIEW (or DISABLED to block it). Editable paths: display_name, description, classification, state, all… - [Delete](https://www.c1.ai/docs/api-reference/mcp-tools/delete.md): Delete soft-deletes an MCP tool. It reappears as PENDING_REVIEW if the connector rediscovers it on the next sync. - [List History](https://www.c1.ai/docs/api-reference/mcp-tools/list-history.md): ListHistory returns the change history (newest first) for a single MCP tool — each entry is a snapshot plus who/when metadata. - [Search](https://www.c1.ai/docs/api-reference/mcp-tools/search.md): Search returns a connector's MCP tools filtered by state, classification, visibility, access-profile binding, or text query. Filter on MCP_TOOL_STATE_PENDING_REVIEW to find tools awaiting approval, then approve them with Update. ### App Entitlement Configuration Rule - [List App Entitlement Routing Rules](https://www.c1.ai/docs/api-reference/app-entitlement-configuration-rule/list-app-entitlement-routing-rules.md): ListAppEntitlementRoutingRules returns an application's entitlement configuration rules in evaluation order, by priority then by ID. - [Create App Entitlement Routing Rule](https://www.c1.ai/docs/api-reference/app-entitlement-configuration-rule/create-app-entitlement-routing-rule.md): CreateAppEntitlementRoutingRule creates an entitlement configuration rule for an application. Rules are evaluated in priority order and the first rule whose condition matches supplies the entitlement's request settings. An app can have at most 5 rules. - [Get App Entitlement Routing Rule](https://www.c1.ai/docs/api-reference/app-entitlement-configuration-rule/get-app-entitlement-routing-rule.md): GetAppEntitlementRoutingRule returns a single entitlement configuration rule by ID. - [Update App Entitlement Routing Rule](https://www.c1.ai/docs/api-reference/app-entitlement-configuration-rule/update-app-entitlement-routing-rule.md): Update an existing app entitlement configuration rule. The app_id field is immutable; moving a rule between apps is modeled as delete + create. - [Delete App Entitlement Routing Rule](https://www.c1.ai/docs/api-reference/app-entitlement-configuration-rule/delete-app-entitlement-routing-rule.md): DeleteAppEntitlementRoutingRule deletes an entitlement configuration rule by ID. - [Reorder App Entitlement Routing Rules](https://www.c1.ai/docs/api-reference/app-entitlement-configuration-rule/reorder-app-entitlement-routing-rules.md): Reorder all configuration rules for an app in a single call. The caller supplies the full ordered list of rule IDs; the server assigns dense priorities (1..N) in that order. The request must be a permutation of every active rule in the app — missing or extra IDs are rejected. ### App Entitlement Automation - [Get Automation](https://www.c1.ai/docs/api-reference/app-entitlement-automation/get-automation.md): Get the automation rule for an app entitlement. - [Delete Automation](https://www.c1.ai/docs/api-reference/app-entitlement-automation/delete-automation.md): Delete the automation rule for an app entitlement. - [Create Automation](https://www.c1.ai/docs/api-reference/app-entitlement-automation/create-automation.md): Create an automation rule for an app entitlement. Automations automatically provision or revoke access based on defined conditions. - [Update Automation](https://www.c1.ai/docs/api-reference/app-entitlement-automation/update-automation.md): Update the automation rule for an app entitlement, including its display name, description, and conditions. ### App Entitlement Automation Exclusion - [List Automation Exclusions](https://www.c1.ai/docs/api-reference/app-entitlement-automation-exclusion/list-automation-exclusions.md): List users who are excluded from the automation rule for an app entitlement. - [Add Automation Exclusion](https://www.c1.ai/docs/api-reference/app-entitlement-automation-exclusion/add-automation-exclusion.md): Add users to the automation exclusion list for an app entitlement. Excluded users are not affected by the automation rule. - [Remove Automation Exclusion](https://www.c1.ai/docs/api-reference/app-entitlement-automation-exclusion/remove-automation-exclusion.md): Remove users from the automation exclusion list for an app entitlement. ### App Entitlement User Binding - [Remove Grant Duration](https://www.c1.ai/docs/api-reference/app-entitlement-user-binding/remove-grant-duration.md): Remove the expiration time from a grant, converting it to an indefinite (standing) grant. - [Update Grant Duration](https://www.c1.ai/docs/api-reference/app-entitlement-user-binding/update-grant-duration.md): Update the expiration time of an existing grant, changing when automatic revocation will occur. - [List App Users For Identity With Grant](https://www.c1.ai/docs/api-reference/app-entitlement-user-binding/list-app-users-for-identity-with-grant.md): Returns a list of app users for the identity in the app. If that app user also has a grant to the entitlement from the request, data about the grant is also returned. It will always return ALL app users for this identity, but only SOME may have grant data. ### App Entitlement Owner - [List Owner I Ds](https://www.c1.ai/docs/api-reference/app-entitlement-owner/list-owner-i-ds.md): ListUserIDs lists owner IDs for a given app entitlement. - [List](https://www.c1.ai/docs/api-reference/app-entitlement-owner/list.md): List owners for a given app entitlement. - [Set](https://www.c1.ai/docs/api-reference/app-entitlement-owner/set.md): Sets the owners for a given app entitlement to the specified list of users. - [Add](https://www.c1.ai/docs/api-reference/app-entitlement-owner/add.md): Add an owner to a given app entitlement. - [Delete](https://www.c1.ai/docs/api-reference/app-entitlement-owner/delete.md): Delete deletes the owners from a given app entitlement. - [Remove](https://www.c1.ai/docs/api-reference/app-entitlement-owner/remove.md): Remove an owner from a given app entitlement. ### App Owner - [List Owner I Ds](https://www.c1.ai/docs/api-reference/app-owner/list-owner-i-ds.md): ListOwnerIDs lists owner IDs for a given app. - [List](https://www.c1.ai/docs/api-reference/app-owner/list.md): List owners of an app. - [Set](https://www.c1.ai/docs/api-reference/app-owner/set.md): Sets the owners for a given app to the specified list of users. - [Delete](https://www.c1.ai/docs/api-reference/app-owner/delete.md): Delete deletes the owners from a given app. - [Add](https://www.c1.ai/docs/api-reference/app-owner/add.md): Adds an owner to an app. - [Remove](https://www.c1.ai/docs/api-reference/app-owner/remove.md): Removes an owner from an app. ### App Reports - [List](https://www.c1.ai/docs/api-reference/app-reports/list.md): Get a list of reports for the given app. - [Generate Report](https://www.c1.ai/docs/api-reference/app-reports/generate-report.md): Generate a report for the given app. ### App Resource Type - [List](https://www.c1.ai/docs/api-reference/app-resource-type/list.md): List app resource types. - [Create Manually Managed Resource Type](https://www.c1.ai/docs/api-reference/app-resource-type/create-manually-managed-resource-type.md): Create a manually managed resource type that classifies resources within an app. - [Get](https://www.c1.ai/docs/api-reference/app-resource-type/get.md): Get an app resource type. - [Update Manually Managed Resource Type](https://www.c1.ai/docs/api-reference/app-resource-type/update-manually-managed-resource-type.md): Update a manually managed resource type's fields. Only the fields specified in the update mask are modified. - [Delete Manually Managed Resource Type](https://www.c1.ai/docs/api-reference/app-resource-type/delete-manually-managed-resource-type.md): Delete a manually managed resource type and all its associated resources from an app. ### App Resource - [List](https://www.c1.ai/docs/api-reference/app-resource/list.md): List app resources for a given app and optionally filter by resource type. - [Create Manually Managed App Resource](https://www.c1.ai/docs/api-reference/app-resource/create-manually-managed-app-resource.md): Create a manually managed app resource tracked directly by ConductorOne under an existing resource type. - [Get](https://www.c1.ai/docs/api-reference/app-resource/get.md): Retrieve a single app resource by its app, resource type, and resource ID. - [Update](https://www.c1.ai/docs/api-reference/app-resource/update.md): Update an app resource's fields. Only the fields specified in the update mask are modified. - [Delete Manually Managed App Resource](https://www.c1.ai/docs/api-reference/app-resource/delete-manually-managed-app-resource.md): Delete a manually managed app resource and its associated entitlements from an app. - [Search App Resource Types](https://www.c1.ai/docs/api-reference/app-resource/search-app-resource-types.md): Search app resources based on filters specified in the request body. - [Search App Resources](https://www.c1.ai/docs/api-reference/app-resource/search-app-resources.md): Search app resources based on filters specified in the request body. ### Application Managed State - [List](https://www.c1.ai/docs/api-reference/application-managed-state/list.md): List the managed states of applications discovered by a connector. - [Get](https://www.c1.ai/docs/api-reference/application-managed-state/get.md): Get the managed state of a discovered application. - [Promote](https://www.c1.ai/docs/api-reference/application-managed-state/promote.md): Promote an unmanaged application into a managed application. Returns AlreadyExists when the application is already managed. The new application inherits source owners when user_ids is omitted. Concurrent promotion requests are not supported. ### App Resource Owner - [List Owner I Ds](https://www.c1.ai/docs/api-reference/app-resource-owner/list-owner-i-ds.md): ListOwnerIDs lists owner IDs for a given app resource. - [Delete](https://www.c1.ai/docs/api-reference/app-resource-owner/delete.md): Delete deletes the owners from a given app resource. - [List](https://www.c1.ai/docs/api-reference/app-resource-owner/list.md): List all owners of an app resource. - [Set](https://www.c1.ai/docs/api-reference/app-resource-owner/set.md): Sets the owners for a given app resource to the specified list of users. - [Add](https://www.c1.ai/docs/api-reference/app-resource-owner/add.md): Add a user as an owner of an app resource. - [Remove](https://www.c1.ai/docs/api-reference/app-resource-owner/remove.md): Remove a user from the owners of an app resource. ### App Usage Controls - [Get](https://www.c1.ai/docs/api-reference/app-usage-controls/get.md): Get usage controls, as an AppUsageControls object which describes some peripheral configuration, for an app. - [Update](https://www.c1.ai/docs/api-reference/app-usage-controls/update.md): Update usage controls for an app. ### App Entitlement Proxy Binding - [Get](https://www.c1.ai/docs/api-reference/app-entitlement-proxy-binding/get.md): Retrieve a specific proxy binding between a source and destination entitlement. - [Create](https://www.c1.ai/docs/api-reference/app-entitlement-proxy-binding/create.md): Create a proxy binding between a source and destination entitlement, establishing a hierarchical relationship. - [Delete](https://www.c1.ai/docs/api-reference/app-entitlement-proxy-binding/delete.md): Delete a proxy binding between a source and destination entitlement. ### Artifact - [List Versions](https://www.c1.ai/docs/api-reference/artifact/list-versions.md): ListVersions returns authorized history in descending numeric version order. Owners can inspect PENDING and FAILED; Readers see only eligible READY versions. - [Get Version](https://www.c1.ai/docs/api-reference/artifact/get-version.md): GetVersion returns the exact numbered version using strong canonical parent and version reads; Owners can inspect PENDING and FAILED, Readers only eligible READY versions. - [Get](https://www.c1.ai/docs/api-reference/artifact/get.md): Get returns current catalog metadata by ID after a strong canonical read. Readers require a published version; Owners can also inspect unpublished Artifacts. - [Delete](https://www.c1.ai/docs/api-reference/artifact/delete.md): Delete deletes an Artifact for a current Owner, preventing ordinary access to its catalog entry and published versions. - [Update](https://www.c1.ai/docs/api-reference/artifact/update.md): Update changes selected catalog name, description or tags for a current Owner. It does not publish content or change the current publication pointer. - [Search](https://www.c1.ai/docs/api-reference/artifact/search.md): Search returns currently authorized Artifacts matching catalog text and tags. Discovery is eventual; newly granted access may appear later than a direct Get. ### Attribute - [Delete Attribute Value](https://www.c1.ai/docs/api-reference/attribute/delete-attribute-value.md): Delete an attribute value by id. - [Create Attribute Value](https://www.c1.ai/docs/api-reference/attribute/create-attribute-value.md): Create a new attribute value. - [Get Attribute Value](https://www.c1.ai/docs/api-reference/attribute/get-attribute-value.md): Get an attribute value by id. - [List Attribute Types](https://www.c1.ai/docs/api-reference/attribute/list-attribute-types.md): List all attribute types. - [List Attribute Values](https://www.c1.ai/docs/api-reference/attribute/list-attribute-values.md): List all attribute values for a given attribute type. - [Search Attribute Values](https://www.c1.ai/docs/api-reference/attribute/search-attribute-values.md): Search attributes based on filters specified in the request body. ### Compliance Framework - [List Compliance Frameworks](https://www.c1.ai/docs/api-reference/compliance-framework/list-compliance-frameworks.md): List all compliance framework attribute values (e.g., SOC 2, HIPAA) with pagination. - [Create Compliance Framework Attribute Value](https://www.c1.ai/docs/api-reference/compliance-framework/create-compliance-framework-attribute-value.md): Create a compliance framework value. - [Get Compliance Framework Attribute Value](https://www.c1.ai/docs/api-reference/compliance-framework/get-compliance-framework-attribute-value.md): Get an attribute value by id. - [Delete Compliance Framework Attribute Value](https://www.c1.ai/docs/api-reference/compliance-framework/delete-compliance-framework-attribute-value.md): Delete an attribute value by id. ### Risk Level - [List Risk Levels](https://www.c1.ai/docs/api-reference/risk-level/list-risk-levels.md): List all risk level attribute values with pagination. - [Create Risk Level Attribute Value](https://www.c1.ai/docs/api-reference/risk-level/create-risk-level-attribute-value.md): Create a risk level attribute. - [Get Risk Level Attribute Value](https://www.c1.ai/docs/api-reference/risk-level/get-risk-level-attribute-value.md): Get a risk level attribute value by id. - [Delete Risk Level Attribute Value](https://www.c1.ai/docs/api-reference/risk-level/delete-risk-level-attribute-value.md): Delete a risk level attribute value by id. ### Auth Config - [List](https://www.c1.ai/docs/api-reference/auth-config/list.md): List returns all authentication provider configurations for the tenant. - [Create](https://www.c1.ai/docs/api-reference/auth-config/create.md): Create registers a new authentication provider configuration for the tenant. - [Get](https://www.c1.ai/docs/api-reference/auth-config/get.md): Get retrieves a single authentication provider configuration by its ID. - [Update](https://www.c1.ai/docs/api-reference/auth-config/update.md): Update modifies an existing authentication provider configuration. Use the update mask to specify which fields to change. - [Delete](https://www.c1.ai/docs/api-reference/auth-config/delete.md): Delete removes an authentication provider configuration from the tenant. ### Auth - [Introspect](https://www.c1.ai/docs/api-reference/auth/introspect.md): Introspect returns the current user's principle_id, user_id and a list of roles, permissions, and enabled features. ### Classifiers - [List Classifier Bindings](https://www.c1.ai/docs/api-reference/classifiers/list-classifier-bindings.md): List returns classifier bindings for the tenant, paginated. - [Create Classifier Binding](https://www.c1.ai/docs/api-reference/classifiers/create-classifier-binding.md): Create attaches a classifier to an enforcement target. - [Delete Classifier Binding](https://www.c1.ai/docs/api-reference/classifiers/delete-classifier-binding.md): Delete removes a classifier binding by ID. - [List Classifiers](https://www.c1.ai/docs/api-reference/classifiers/list-classifiers.md): List returns classifiers for the tenant, paginated. - [Create Classifier](https://www.c1.ai/docs/api-reference/classifiers/create-classifier.md): Create creates a classifier. - [Get Classifier](https://www.c1.ai/docs/api-reference/classifiers/get-classifier.md): Get returns a classifier by ID. - [Update Classifier](https://www.c1.ai/docs/api-reference/classifiers/update-classifier.md): Update modifies a classifier's mutable fields. - [Delete Classifier](https://www.c1.ai/docs/api-reference/classifiers/delete-classifier.md): Delete removes a classifier by ID. ### Classifier Templates - [Get Classifier Template](https://www.c1.ai/docs/api-reference/classifier-templates/get-classifier-template.md): Get returns a classifier template revision. An empty template_version selects the latest revision. - [Instantiate Classifier Template](https://www.c1.ai/docs/api-reference/classifier-templates/instantiate-classifier-template.md): Instantiate creates a tenant-owned, editable classifier from a template revision. It binds supplied tenant parameters, resolves required tool gates and hooks, rewrites their references, and records the source template. - [List Classifier Templates](https://www.c1.ai/docs/api-reference/classifier-templates/list-classifier-templates.md): List returns classifier templates for the tenant, paginated. - [Add Classifier Rule From Template](https://www.c1.ai/docs/api-reference/classifier-templates/add-classifier-rule-from-template.md): Add inserts a template rule into a tenant-owned classifier at insert_index. It resolves only that rule's required tool gates and hooks, rewrites their references, assigns a new rule ID, and records the source template. Grant-policy parameters are validated only for the added rule. ### Connector Authoring Activation - [Activate Revision](https://www.c1.ai/docs/api-reference/connector-authoring-activation/activate-revision.md): ActivateRevision redeems a one-time approval token to activate a built connector revision onto its instance connector. It is OWNER-only. Double-activate protection is the single-use approval token itself: redeeming it is a compare-and-swap that rejects a second redemption of the same token. idem… - [Rollback Revision](https://www.c1.ai/docs/api-reference/connector-authoring-activation/rollback-revision.md): RollbackRevision redeems a one-time approval token (bound to the rollback target's integrity root) to re-point the published + instance pointers at a previously activated, still-servable revision under a strictly greater activation epoch. It is OWNER-only. The rolled-back-FROM revision's serve s… ### Connector Catalog - [Configuration Schema](https://www.c1.ai/docs/api-reference/connector-catalog/configuration-schema.md): Return the configuration schema describing the fields required to set up a connector of the specified type. ### Conversations - [Ensure Onboarding Session](https://www.c1.ai/docs/api-reference/conversations/ensure-onboarding-session.md): EnsureOnboardingSession returns the tenant's active onboarding conversation, or creates and starts it once. Retries converge on the stored conversation. ### Credential Inventory - [List](https://www.c1.ai/docs/api-reference/credential-inventory/list.md): List all credential inventory policies in your tenant, one page at a time. - [Create](https://www.c1.ai/docs/api-reference/credential-inventory/create.md): Create a credential inventory policy. - [Get](https://www.c1.ai/docs/api-reference/credential-inventory/get.md): Get a credential inventory policy by ID. - [Update](https://www.c1.ai/docs/api-reference/credential-inventory/update.md): Update a credential inventory policy. Supply the policy object and an update mask listing the fields to change; omitted fields are left as-is. - [Delete](https://www.c1.ai/docs/api-reference/credential-inventory/delete.md): Delete a credential inventory policy by ID. - [Search](https://www.c1.ai/docs/api-reference/credential-inventory/search.md): Search credential inventory policies by name, or fetch a specific set by ID. Returns one page of matching policies at a time. ### Decoy - [List](https://www.c1.ai/docs/api-reference/decoy/list.md): List returns decoys for the tenant, paginated. - [Create](https://www.c1.ai/docs/api-reference/decoy/create.md): Create mints a decoy credential and returns the one-time vending material exactly once. The Decoy id is server-set; the credential's secret cannot be retrieved again after this response. - [Get](https://www.c1.ai/docs/api-reference/decoy/get.md): Get returns a decoy by id. - [Delete](https://www.c1.ai/docs/api-reference/decoy/delete.md): Delete soft-deletes a decoy and disables the paired credential row. - [Update](https://www.c1.ai/docs/api-reference/decoy/update.md): Update modifies mutable metadata on a decoy. The decoy variant is fixed at Create -- rotate the secret with Rotate instead. - [Rotate](https://www.c1.ai/docs/api-reference/decoy/rotate.md): Rotate re-mints the paired credential's secret material, preserves the decoy_id binding, and returns the new one-time vending material. - [Search](https://www.c1.ai/docs/api-reference/decoy/search.md): Search decoys with free-text query and filters for kind, status, and annotation key. ### Directory - [List](https://www.c1.ai/docs/api-reference/directory/list.md): List directories. - [Create](https://www.c1.ai/docs/api-reference/directory/create.md): Create a directory. - [Get](https://www.c1.ai/docs/api-reference/directory/get.md): Get a directory by app_id. - [Update](https://www.c1.ai/docs/api-reference/directory/update.md): Update a directory by app_id. - [Delete](https://www.c1.ai/docs/api-reference/directory/delete.md): Delete a directory by app_id. ### Feedback - [Create Feedback](https://www.c1.ai/docs/api-reference/feedback/create-feedback.md): Create feedback with client diagnostics, Datadog correlation context, and up to five WebP screenshots. Gated by the feedback feature flag; the submitter's identity is taken from the session, not the request. ### Findings - [Create Finding](https://www.c1.ai/docs/api-reference/findings/create-finding.md): Create a user-authored custom finding. - [Update Finding Assignee](https://www.c1.ai/docs/api-reference/findings/update-finding-assignee.md): Assign or clear a finding's assignee. - [Update Finding State](https://www.c1.ai/docs/api-reference/findings/update-finding-state.md): Update finding workflow state (snooze, accept risk, suppress, reopen, resolve). - [Create Finding Task](https://www.c1.ai/docs/api-reference/findings/create-finding-task.md): Create a task for a finding. - [Get Finding](https://www.c1.ai/docs/api-reference/findings/get-finding.md): Get a single finding by ID. - [Bulk Update Finding State](https://www.c1.ai/docs/api-reference/findings/bulk-update-finding-state.md): Bulk update finding states. - [Bulk Create Finding Tasks](https://www.c1.ai/docs/api-reference/findings/bulk-create-finding-tasks.md): Bulk create tasks for findings. - [Search](https://www.c1.ai/docs/api-reference/findings/search.md): Search findings using full-text query and filters for severity, state, type, and app. Each Finding row is large (risk factors, evidence, target, tags) — request a small page_size (≤10) to keep responses small. - [Search](https://www.c1.ai/docs/api-reference/findings/search-1.md): Search returns audit events filtered by finding, actor, type, or app. Authorized as VIEWER -- the same role required to read the finding itself. - [Search](https://www.c1.ai/docs/api-reference/findings/search-2.md): Search returns the ungoverned, enabled observation rows behind one shadow-mcp finding -- the same present-set that produced its evidence counts. Authorized as VIEWER -- the same role required to read the finding itself. ### Finding Routing Rules - [List Finding Routing Rules](https://www.c1.ai/docs/api-reference/finding-routing-rules/list-finding-routing-rules.md): List finding routing rules, optionally filtered to a specific app. - [Create Finding Routing Rule](https://www.c1.ai/docs/api-reference/finding-routing-rules/create-finding-routing-rule.md): Create a new finding routing rule that defines which policy to use for auto-routing matching findings. - [Get Finding Routing Rule](https://www.c1.ai/docs/api-reference/finding-routing-rules/get-finding-routing-rule.md): Retrieve a single finding routing rule by ID. - [Delete Finding Routing Rule](https://www.c1.ai/docs/api-reference/finding-routing-rules/delete-finding-routing-rule.md): Delete a finding routing rule. Findings already routed by this rule are not affected. - [Update Finding Routing Rule](https://www.c1.ai/docs/api-reference/finding-routing-rules/update-finding-routing-rule.md): Update an existing finding routing rule's match criteria or target policy. ### Finding Settings - [List Finding Settings](https://www.c1.ai/docs/api-reference/finding-settings/list-finding-settings.md): List every configurable finding type and whether detection is enabled. - [Get Edge Finding Settings](https://www.c1.ai/docs/api-reference/finding-settings/get-edge-finding-settings.md): Get whether each Edge finding category is detected. Categories never configured read back their shipped default. The Edge finding type's own switch (ListFindingSettings) still gates every category. - [Update Edge Finding Settings](https://www.c1.ai/docs/api-reference/finding-settings/update-edge-finding-settings.md): Enable or disable detection for one or more Edge finding categories in a single write. - [Update Finding Settings](https://www.c1.ai/docs/api-reference/finding-settings/update-finding-settings.md): Enable or disable detection for one or more finding types in a single write. Enabling a type whose detector is a scheduled job also queues an immediate run. ### Finding Transformation Rules - [List Finding Transformation Rules](https://www.c1.ai/docs/api-reference/finding-transformation-rules/list-finding-transformation-rules.md): List finding transformation rules, optionally filtered to a specific app. - [Create Finding Transformation Rule](https://www.c1.ai/docs/api-reference/finding-transformation-rules/create-finding-transformation-rule.md): Create a new finding transformation rule. - [Get Finding Transformation Rule](https://www.c1.ai/docs/api-reference/finding-transformation-rules/get-finding-transformation-rule.md): Retrieve a single finding transformation rule by ID. - [Delete Finding Transformation Rule](https://www.c1.ai/docs/api-reference/finding-transformation-rules/delete-finding-transformation-rule.md): Delete a finding transformation rule. Findings already transformed by this rule are not affected. - [Update Finding Transformation Rule](https://www.c1.ai/docs/api-reference/finding-transformation-rules/update-finding-transformation-rule.md): Update an existing finding transformation rule's match criteria or transforms. ### Function - [List Functions](https://www.c1.ai/docs/api-reference/function/list-functions.md): List retrieves all functions with pagination - [Create Function](https://www.c1.ai/docs/api-reference/function/create-function.md): CreateFunction registers a new serverless function and creates its initial code commit. Functions run as TypeScript modules in a sandboxed runtime; see initial_content for the entry-file signature and SDK import. - [Invoke](https://www.c1.ai/docs/api-reference/function/invoke.md): Invoke executes a function at a specific commit with the provided input data. - [Test](https://www.c1.ai/docs/api-reference/function/test.md): Test runs a function's test suite in a sandboxed environment and returns the results. - [Get Function](https://www.c1.ai/docs/api-reference/function/get-function.md): Get retrieves a specific function by ID - [Delete Function](https://www.c1.ai/docs/api-reference/function/delete-function.md): Delete removes a function - [Update Function](https://www.c1.ai/docs/api-reference/function/update-function.md): Update an existing function's metadata, code, or both. Also the publish path: set function.published_commit_id and include "published_commit_id" in update_mask to make a commit the default runnable version. To push a new code commit, set content (and optionally commit_message); this is independe… - [Search](https://www.c1.ai/docs/api-reference/function/search.md): Search searches for functions based on criteria ### Function Commit - [List Commits](https://www.c1.ai/docs/api-reference/function-commit/list-commits.md): ListCommits retrieves the commit history - [Create Initial Commit](https://www.c1.ai/docs/api-reference/function-commit/create-initial-commit.md): CreateInitialCommit starts a new commit and returns upload URLs for files - [Create Final Commit](https://www.c1.ai/docs/api-reference/function-commit/create-final-commit.md): CreateFinalCommit completes a commit after files are uploaded - [Get Lock File](https://www.c1.ai/docs/api-reference/function-commit/get-lock-file.md): GetLockFile retrieves the deno lock file for a specific commit, if it exists. - [Get Commit Content](https://www.c1.ai/docs/api-reference/function-commit/get-commit-content.md): GetCommitContent retrieves a commit and all its file contents in a single unary response. This is a non-streaming alternative to GetCommit for REST API consumers. ### Function Invocation - [List](https://www.c1.ai/docs/api-reference/function-invocation/list.md): List retrieves the invocation history for a function - [Get](https://www.c1.ai/docs/api-reference/function-invocation/get.md): Get retrieves a specific invocation by ID - [Get Result Download Url](https://www.c1.ai/docs/api-reference/function-invocation/get-result-download-url.md): GetResultDownloadURL mints a short-lived download URL for an invocation result held outside the invocation row. The URL is generated at request time and never persisted; the invocation object itself exposes only the result's VFS path, size, checksum, media type, and expiry. - [Search](https://www.c1.ai/docs/api-reference/function-invocation/search.md): Search searches for function invocations with filtering and ordering support Each invocation carries its input/output payloads, which can be large — request a small page_size (≤10) to keep responses small. ### Function Tag - [List Tags](https://www.c1.ai/docs/api-reference/function-tag/list-tags.md): ListTags lists all tags for a function - [Create Tag](https://www.c1.ai/docs/api-reference/function-tag/create-tag.md): CreateTag creates a named reference to a specific commit ### Fund App Caps - [List](https://www.c1.ai/docs/api-reference/fund-app-caps/list.md): List every capped app in the tenant. Cardinality is the tenant's installed App count, so this is one runtime-plane query. - [Get](https://www.c1.ai/docs/api-reference/fund-app-caps/get.md): Get returns the tenant's ceiling for one app, together with any suspension acting as that app's kill switch. An app with no cap is not found, meaning nothing bounds it beyond the fund the spender already has. - [Delete](https://www.c1.ai/docs/api-reference/fund-app-caps/delete.md): Delete the cap entirely. The app is no longer bounded tenant-wide. - [List History](https://www.c1.ai/docs/api-reference/fund-app-caps/list-history.md): List the change history for one app's cap, newest first. Admin-tier per the object-history convention. A cap cleared down to nothing is deleted, and its history is where the kill switch that preceded the delete is still readable. - [Set Limit](https://www.c1.ai/docs/api-reference/fund-app-caps/set-limit.md): Set the app's tenant-wide ceiling, creating the cap if absent. Leaves any suspension in place. - [Suspend](https://www.c1.ai/docs/api-reference/fund-app-caps/suspend.md): Kill the app tenant-wide. The cap amount underneath is preserved and restored by Unsuspend. - [Unsuspend](https://www.c1.ai/docs/api-reference/fund-app-caps/unsuspend.md): Bring the app back, restoring the cap it froze. ### Fund Assignments - [Get](https://www.c1.ai/docs/api-reference/fund-assignments/get.md): Get returns one subject's exception: their own limit, any extension running on top of it, and any suspension. A subject with no exception is not found rather than reported at the tenant default, because no row is what "this subject is governed by the layers above" looks like. - [Delete](https://www.c1.ai/docs/api-reference/fund-assignments/delete.md): Delete the whole assignment. The subject falls back to the rules and the tenant default. - [Grant Extension](https://www.c1.ai/docs/api-reference/fund-assignments/grant-extension.md): Grant a temporary total until expires_at. Never changes the period, and never expresses a refusal — a temporary refusal is a suspension. - [Clear Extension](https://www.c1.ai/docs/api-reference/fund-assignments/clear-extension.md): Revoke the extension early. The base limit underneath is untouched. - [List History](https://www.c1.ai/docs/api-reference/fund-assignments/list-history.md): List the change history for one subject's assignment, newest first. - [Set Limit](https://www.c1.ai/docs/api-reference/fund-assignments/set-limit.md): Set the subject's base limit, creating the assignment if absent. Leaves any extension and any suspension in place. - [Suspend](https://www.c1.ai/docs/api-reference/fund-assignments/suspend.md): Freeze the subject's fund. The limit and any extension underneath are preserved and restored by Unsuspend. - [Unsuspend](https://www.c1.ai/docs/api-reference/fund-assignments/unsuspend.md): Lift the suspension, restoring the numbers it froze. - [Search](https://www.c1.ai/docs/api-reference/fund-assignments/search.md): Search the tenant's assignments. Reads the Postgres mirror: the runtime row is keyed on (tenant, user), so there is no cross-subject query on the runtime plane at all. ### My Fund Limits - [List](https://www.c1.ai/docs/api-reference/my-fund-limits/list.md): List the caller's own per-app limits. - [Delete](https://www.c1.ai/docs/api-reference/my-fund-limits/delete.md): Remove the caller's limit on this app entirely. The app is then bounded only by the fund and by any tenant-wide cap. - [List History](https://www.c1.ai/docs/api-reference/my-fund-limits/list-history.md): List the change history for one of the caller's own per-app limits, newest first. Removing the last control deletes the row, so this is where a subject reads back the pause they lifted and when they lifted it. - [Set Limit](https://www.c1.ai/docs/api-reference/my-fund-limits/set-limit.md): Cap what one app may take from the caller's own fund. Amount arm only. - [Pause](https://www.c1.ai/docs/api-reference/my-fund-limits/pause.md): Pause one app on the caller's own fund. The limit underneath is preserved and restored by Resume. Denials name this as paused by you. - [Resume](https://www.c1.ai/docs/api-reference/my-fund-limits/resume.md): Un-pause the app, restoring the limit it froze. - [Set Temporary Limit](https://www.c1.ai/docs/api-reference/my-fund-limits/set-temporary-limit.md): Temporarily replace this app's self limit, not the fund supplying it. - [Clear Temporary Limit](https://www.c1.ai/docs/api-reference/my-fund-limits/clear-temporary-limit.md): Remove the temporary limit, using the current base rather than an old copy. ### Fund Policy - [Get](https://www.c1.ai/docs/api-reference/fund-policy/get.md): Get the tenant's fund policy. An absent policy is a configuration state that prevents enabled metered inference from serving traffic. - [Create](https://www.c1.ai/docs/api-reference/fund-policy/create.md): Create the tenant's fund policy. default_limit is required: a tenant states its posture explicitly, and there is no implicit default anywhere in the write path. - [Delete](https://www.c1.ai/docs/api-reference/fund-policy/delete.md): Delete the tenant's fund policy. Refused while spend governance is enabled because enabled inference requires this row. Disable governance and drain in-flight leases before calling Delete. - [Set Org Ceiling](https://www.c1.ai/docs/api-reference/fund-policy/set-org-ceiling.md): Set the org-wide ceiling: the bound on the tenant's total regardless of what any principal was granted. Amount arm only. An absent limit clears the ceiling only after spend governance is disabled. - [Freeze Tenant](https://www.c1.ai/docs/api-reference/fund-policy/freeze-tenant.md): Freeze the whole tenant. The ceiling amount underneath is preserved and restored by Unfreeze. - [Unfreeze Tenant](https://www.c1.ai/docs/api-reference/fund-policy/unfreeze-tenant.md): Lift the tenant freeze, restoring the ceiling it froze. - [List History](https://www.c1.ai/docs/api-reference/fund-policy/list-history.md): List the change history for the fund policy, newest first. Admin-tier per the object-history convention. - [Update](https://www.c1.ai/docs/api-reference/fund-policy/update.md): Update the period or the default limit. currency_code is fixed to USD at Create and immutable thereafter; update_mask rejects it. ### Fund Rules - [List](https://www.c1.ai/docs/api-reference/fund-rules/list.md): List every rule in the tenant. Reads the runtime plane: rule cardinality is the tenant's rule count, so this is the same one-partition read resolution does. - [Create](https://www.c1.ai/docs/api-reference/fund-rules/create.md): Create funds a group. The group is an AppEntitlement, so membership resolves through that entitlement's bindings on every acquire rather than being captured here. Creating the tenant's first rule is what turns group resolution on for that tenant. - [Get](https://www.c1.ai/docs/api-reference/fund-rules/get.md): Get returns one rule: the group it funds, the grant it carries, and the label and reason an admin reads it by. A deleted rule is not found. - [Update](https://www.c1.ai/docs/api-reference/fund-rules/update.md): Update replaces the group, grant, label or reason on one rule, whichever the field mask names. The new grant governs the next acquire; spend already accounted for against the old one is not revisited. - [Delete](https://www.c1.ai/docs/api-reference/fund-rules/delete.md): Delete withdraws a group grant. The cohort keeps whatever the tenant default and any other rule matching them still allow, so this narrows their fund rather than necessarily cutting it off. The rule's history survives. - [List History](https://www.c1.ai/docs/api-reference/fund-rules/list-history.md): List the change history for one rule, newest first. Admin-tier per the object-history convention. A deleted rule keeps its history: the delete is the last entry, and the one before it is the rule as it last stood. - [Search](https://www.c1.ai/docs/api-reference/fund-rules/search.md): Search rules by display name. Reads the Postgres mirror. ### Short Links - [List](https://www.c1.ai/docs/api-reference/short-links/list.md): List GoLinks with pagination. - [Create](https://www.c1.ai/docs/api-reference/short-links/create.md): Create a new GoLink. - [List Versions](https://www.c1.ai/docs/api-reference/short-links/list-versions.md): List version history for a GoLink. - [Get](https://www.c1.ai/docs/api-reference/short-links/get.md): Get a GoLink by ID. - [Delete](https://www.c1.ai/docs/api-reference/short-links/delete.md): Delete a GoLink. Caller must be the owner. - [Update](https://www.c1.ai/docs/api-reference/short-links/update.md): Update a GoLink. Caller must be the owner. - [Resolve](https://www.c1.ai/docs/api-reference/short-links/resolve.md): Resolve a path to a GoLink target. Returns the resolution outcome (redirect URL, action, chooser, prerequisite, etc.) - [Search](https://www.c1.ai/docs/api-reference/short-links/search.md): Search GoLinks by query string. ### App Entitlement User Binding Feed - [Search Grant Feed](https://www.c1.ai/docs/api-reference/app-entitlement-user-binding-feed/search-grant-feed.md): Search a chronological feed of grant and revoke events, filtered by app user, entitlement, or time range. ### Hook - [List](https://www.c1.ai/docs/api-reference/hook/list.md): List returns all hooks for the tenant, paginated. - [Create](https://www.c1.ai/docs/api-reference/hook/create.md): Create creates a hook. The hook fires on the configured event, optionally filtered by a CEL expression. Creating a Patch tool input hook requires the preview feature to be enabled for the tenant. - [Get](https://www.c1.ai/docs/api-reference/hook/get.md): Get returns a hook by ID. - [Update](https://www.c1.ai/docs/api-reference/hook/update.md): Update modifies a hook's display name, description, event, filter, priority, or configuration. A hook referenced by a guardrail rule cannot stop being managed by guardrails until the reference is removed. - [Delete](https://www.c1.ai/docs/api-reference/hook/delete.md): Delete removes a hook by ID. A hook referenced by a guardrail rule cannot be deleted until the reference is removed. - [Search](https://www.c1.ai/docs/api-reference/hook/search.md): Search returns hooks for the tenant, paginated. Setting query or refs returns UNIMPLEMENTED; filtering is not yet supported. ### Model API Key - [List](https://www.c1.ai/docs/api-reference/model-api-key/list.md): List returns all model API keys owned by the calling user. - [Create](https://www.c1.ai/docs/api-reference/model-api-key/create.md): Create generates a new model API key for the caller. - [Get](https://www.c1.ai/docs/api-reference/model-api-key/get.md): Get retrieves a model API key by its ID (metadata only, no secret). - [Revoke](https://www.c1.ai/docs/api-reference/model-api-key/revoke.md): Revoke deactivates a model API key, preventing further use. ### Personal Client - [NOTE: Only shows personal clients for the current user.](https://www.c1.ai/docs/api-reference/personal-client/note:-only-shows-personal-clients-for-the-current-user.md): List returns all personal client credentials owned by the calling user. - [Create](https://www.c1.ai/docs/api-reference/personal-client/create.md): Create creates a new PersonalClient object for the current User. - [Get](https://www.c1.ai/docs/api-reference/personal-client/get.md): Get retrieves a single personal client credential by its ID. - [Update](https://www.c1.ai/docs/api-reference/personal-client/update.md): Update modifies an existing personal client credential. Use the update mask to specify which fields to change. - [Delete](https://www.c1.ai/docs/api-reference/personal-client/delete.md): Delete a personal client credential, revoking it and preventing further API access. - [NOTE: Searches personal clients for all users](https://www.c1.ai/docs/api-reference/personal-client/note:-searches-personal-clients-for-all-users.md): Search finds personal client credentials across all users, with optional filtering by query text or user. Request a modest page_size (≤25) to keep responses small. ### Personal Device - [Get Device](https://www.c1.ai/docs/api-reference/personal-device/get-device.md): GetDevice retrieves a single device (by device_id) with its child clients. - [NOTE: Only updates devices owned by the current user.](https://www.c1.ai/docs/api-reference/personal-device/note:-only-updates-devices-owned-by-the-current-user.md): UpdateDevice renames one of the calling user's devices. Use the update mask to specify which fields to change; only the display name is mutable, so device identity and keys never change. - [Revoke Device](https://www.c1.ai/docs/api-reference/personal-device/revoke-device.md): RevokeDevice revokes a whole device: it revokes the device and removes every app client on it, so no app on that machine can mint further tokens. - [List Device Clients](https://www.c1.ai/docs/api-reference/personal-device/list-device-clients.md): ListDeviceClients returns the app clients registered on a device, one page at a time. A device can accrue many app clients over time, so the clients are served from this dedicated paginated endpoint rather than inlined on the device. - [Revoke Device Client](https://www.c1.ai/docs/api-reference/personal-device/revoke-device-client.md): RevokeDeviceClient revokes a single app client on a device: it removes that client, leaving the device and its other clients intact. - [NOTE: Only shows devices for the current user.](https://www.c1.ai/docs/api-reference/personal-device/note:-only-shows-devices-for-the-current-user.md): Search returns the calling user's registered devices, ordered by display name. By default only active devices are returned; use the status filter to include revoked devices. Optionally filter by a display-name query. ### Role - [List](https://www.c1.ai/docs/api-reference/role/list.md): List all roles for the current user. - [Get](https://www.c1.ai/docs/api-reference/role/get.md): Get a role by id. - [Update](https://www.c1.ai/docs/api-reference/role/update.md): Update a role by passing a Role object. ### Tunnel - [List Bridges](https://www.c1.ai/docs/api-reference/tunnel/list-bridges.md): ListBridges returns the tenant's bridges, paginated, each with live appliance status. - [Create Bridge](https://www.c1.ai/docs/api-reference/tunnel/create-bridge.md): CreateBridge creates a bridge with no credentials. Use CreateBridgeCredential to mint the first credential. - [List Bridge Announced Services](https://www.c1.ai/docs/api-reference/tunnel/list-bridge-announced-services.md): ListBridgeAnnouncedServices returns the services the appliance is currently announcing for this bridge. Read live from the tunnel store; empty when no appliance is connected. - [List Bridge Credentials](https://www.c1.ai/docs/api-reference/tunnel/list-bridge-credentials.md): ListBridgeCredentials returns every credential (active + revoked) for one bridge. - [Create Bridge Credential](https://www.c1.ai/docs/api-reference/tunnel/create-bridge-credential.md): CreateBridgeCredential mints a credential for a bridge. If the bridge already has an active credential, it is revoked. The plaintext client_secret is returned exactly once on the response. - [Get Bridge](https://www.c1.ai/docs/api-reference/tunnel/get-bridge.md): GetBridge returns a bridge by id with live appliance status. - [Delete Bridge](https://www.c1.ai/docs/api-reference/tunnel/delete-bridge.md): DeleteBridge hard-deletes a bridge and every credential it owns. - [Update Bridge](https://www.c1.ai/docs/api-reference/tunnel/update-bridge.md): UpdateBridge patches a bridge's editable metadata (display_name, description). Credentials are not affected. - [Revoke Bridge Credential](https://www.c1.ai/docs/api-reference/tunnel/revoke-bridge-credential.md): RevokeBridgeCredential soft-revokes one credential by id. The row is retained for audit; token mints with this credential are rejected. ### LLM Gateway Keys - [List](https://www.c1.ai/docs/api-reference/llm-gateway-keys/list.md): List returns the tenant's LLM gateway API keys. Only key metadata and a key prefix are returned, never the full key. - [Mint](https://www.c1.ai/docs/api-reference/llm-gateway-keys/mint.md): Mint creates a new LLM gateway API key. The key value is shown only in this response and cannot be retrieved again; store it immediately. - [Revoke](https://www.c1.ai/docs/api-reference/llm-gateway-keys/revoke.md): Revoke revokes an LLM gateway API key by ID. The key immediately stops authenticating gateway requests. ### LLM Gateway Provider Credentials - [Get](https://www.c1.ai/docs/api-reference/llm-gateway-provider-credentials/get.md): Get returns metadata for the provider credential in the given slot. The stored API key is never returned. Returns an empty response if no credential has ever been set for the slot; a cleared slot returns FAILED_PRECONDITION. - [Set](https://www.c1.ai/docs/api-reference/llm-gateway-provider-credentials/set.md): Set stores or replaces the provider API key used by the LLM gateway for the given slot. The API key is stored encrypted and is never returned by the API. - [Clear](https://www.c1.ai/docs/api-reference/llm-gateway-provider-credentials/clear.md): Clear deletes the provider credential stored in the given slot. ### Local Directory - [List](https://www.c1.ai/docs/api-reference/local-directory/list.md): List local directory configs for the tenant. - [Create](https://www.c1.ai/docs/api-reference/local-directory/create.md): Create a new local directory config backed by an existing App. - [Get](https://www.c1.ai/docs/api-reference/local-directory/get.md): Get a local directory config by app_id. - [Update](https://www.c1.ai/docs/api-reference/local-directory/update.md): Update a local directory config. - [Delete](https://www.c1.ai/docs/api-reference/local-directory/delete.md): Delete a local directory config. Does not delete the underlying App. - [Create](https://www.c1.ai/docs/api-reference/local-directory/create-1.md): Create (send) a new invitation to a user. - [Get](https://www.c1.ai/docs/api-reference/local-directory/get-1.md): Get a specific invitation by id. - [Revoke](https://www.c1.ai/docs/api-reference/local-directory/revoke.md): Revoke a pending invitation. - [Search](https://www.c1.ai/docs/api-reference/local-directory/search.md): List invitations for a directory, with optional status filter. Search invitations with filters (directory, status). ### Policy - [List](https://www.c1.ai/docs/api-reference/policy/list.md): List policies. - [Create](https://www.c1.ai/docs/api-reference/policy/create.md): Create a policy. - [Get](https://www.c1.ai/docs/api-reference/policy/get.md): Get a policy by ID. - [Update](https://www.c1.ai/docs/api-reference/policy/update.md): Update a policy by providing a policy object and an update mask. - [Delete](https://www.c1.ai/docs/api-reference/policy/delete.md): Delete a policy by ID. - [Test](https://www.c1.ai/docs/api-reference/policy/test.md): Test an account provision policy by evaluating a CEL expression and returning the computed result. - [Validate Cel](https://www.c1.ai/docs/api-reference/policy/validate-cel.md): Validate policies - [Search](https://www.c1.ai/docs/api-reference/policy/search.md): Search policies based on filters specified in the request body. ### Recovery Policy - [List](https://www.c1.ai/docs/api-reference/recovery-policy/list.md): List all recovery policies in your tenant, one page at a time. - [Create](https://www.c1.ai/docs/api-reference/recovery-policy/create.md): Create a recovery policy. - [Get](https://www.c1.ai/docs/api-reference/recovery-policy/get.md): Get a recovery policy by ID. - [Update](https://www.c1.ai/docs/api-reference/recovery-policy/update.md): Update a recovery policy. Supply the policy object and an update mask listing the fields to change; omitted fields are left as-is. - [Delete](https://www.c1.ai/docs/api-reference/recovery-policy/delete.md): Delete a recovery policy by ID. - [Search](https://www.c1.ai/docs/api-reference/recovery-policy/search.md): Search recovery policies by name, or fetch a specific set by ID. Returns one page of matching policies at a time. ### Request Schema Entitlement Binding - [Find Binding For App Entitlement](https://www.c1.ai/docs/api-reference/request-schema-entitlement-binding/find-binding-for-app-entitlement.md): Look up which request schema is bound to a given app entitlement. - [Create Entitlement Binding](https://www.c1.ai/docs/api-reference/request-schema-entitlement-binding/create-entitlement-binding.md): Link a request schema to a single app entitlement so the form is shown when requesting that entitlement. - [Remove Entitlement Binding](https://www.c1.ai/docs/api-reference/request-schema-entitlement-binding/remove-entitlement-binding.md): Remove the link between a request schema and a single app entitlement. ### Request Schema - [Create](https://www.c1.ai/docs/api-reference/request-schema/create.md): Create a new request schema that defines a form template for access requests. - [Get](https://www.c1.ai/docs/api-reference/request-schema/get.md): Retrieve a single request schema by ID. - [Update](https://www.c1.ai/docs/api-reference/request-schema/update.md): Update an existing request schema's form definition or settings. - [Delete](https://www.c1.ai/docs/api-reference/request-schema/delete.md): Delete a request schema by ID. Associated entitlement bindings are also deleted. ### App Secrets - [Search My Vended Credentials](https://www.c1.ai/docs/api-reference/app-secrets/search-my-vended-credentials.md): Lists credentials C1 issued to the signed-in requester. This is separate from the general secret inventory because a connector can discover other secret resources on the same account. ### External Client - [NOTE: Searches external client grants for all users](https://www.c1.ai/docs/api-reference/external-client/note:-searches-external-client-grants-for-all-users.md): Search returns external client grants for all users in the tenant. Request a modest page_size (≤25) to keep responses small. ### App Entitlement User Binding History - [Search Past Grants](https://www.c1.ai/docs/api-reference/app-entitlement-user-binding-history/search-past-grants.md): Search historical grants that have been revoked, filtered by app user or entitlement. ### Secrets Admin - [Search](https://www.c1.ai/docs/api-reference/secrets-admin/search.md): Search returns secrets across the tenant. Can filter by creator, sharing mode, status, time range, etc. - [Search Audit Events](https://www.c1.ai/docs/api-reference/secrets-admin/search-audit-events.md): SearchAuditEvents returns audit events for paper secrets. Can filter by vault_id, actor (user ID or email), client IP. - [Get](https://www.c1.ai/docs/api-reference/secrets-admin/get.md): Get retrieves any secret's metadata by vault ID (admin override). - [Delete](https://www.c1.ai/docs/api-reference/secrets-admin/delete.md): Delete allows an admin to delete any Paper Vault. ### Sign-In Policy - [Search](https://www.c1.ai/docs/api-reference/sign-in-policy/search.md): Search sign-in policies by name, or fetch a specific set by ID. Returns one page of matching policies at a time. - [List](https://www.c1.ai/docs/api-reference/sign-in-policy/list.md): List all sign-in policies in your tenant, one page at a time. - [Create](https://www.c1.ai/docs/api-reference/sign-in-policy/create.md): Create a sign-in policy. - [Get](https://www.c1.ai/docs/api-reference/sign-in-policy/get.md): Get a sign-in policy by ID. - [Update](https://www.c1.ai/docs/api-reference/sign-in-policy/update.md): Update a sign-in policy. Supply the policy object and an update mask listing the fields to change; omitted fields are left as-is. - [Delete](https://www.c1.ai/docs/api-reference/sign-in-policy/delete.md): Delete a sign-in policy by ID. ### SSF Receiver - [Search](https://www.c1.ai/docs/api-reference/ssf-receiver/search.md): Search performs a full-text search across received SSF events with optional filters for stream, event type, outcome, and matched user. Request a modest page_size (≤25) to keep responses small. - [List](https://www.c1.ai/docs/api-reference/ssf-receiver/list.md): List returns a paginated list of all SSF receiver streams configured for the tenant. - [Create](https://www.c1.ai/docs/api-reference/ssf-receiver/create.md): Create registers a new SSF receiver stream with the specified configuration and returns the created stream along with the push auth token (if push delivery). - [Get](https://www.c1.ai/docs/api-reference/ssf-receiver/get.md): Get retrieves a single SSF receiver stream by its ID. - [Update](https://www.c1.ai/docs/api-reference/ssf-receiver/update.md): Update modifies an existing SSF receiver stream's configuration. Only fields specified in the update mask are changed. - [Delete](https://www.c1.ai/docs/api-reference/ssf-receiver/delete.md): Delete removes an SSF receiver stream and stops receiving events from the associated transmitter. - [Test](https://www.c1.ai/docs/api-reference/ssf-receiver/test.md): Test validates an SSF receiver stream's configuration by checking JWKS reachability, identity resolution, and action preview without processing real events. - [List](https://www.c1.ai/docs/api-reference/ssf-receiver/list-1.md): List returns a paginated list of events received on a specific SSF receiver stream, ordered by receipt time. - [Get Stats](https://www.c1.ai/docs/api-reference/ssf-receiver/get-stats.md): GetStats retrieves event processing statistics for a specific SSF receiver stream, including counts of received, acted-on, and failed events. ### Step Up Authentication Providers - [Search](https://www.c1.ai/docs/api-reference/step-up-authentication-providers/search.md): Search allows searching for step-up providers with various filters - [List](https://www.c1.ai/docs/api-reference/step-up-authentication-providers/list.md): List returns all step-up authentication providers configured for the tenant. - [Create](https://www.c1.ai/docs/api-reference/step-up-authentication-providers/create.md): Create registers a new step-up authentication provider for the tenant. - [Get](https://www.c1.ai/docs/api-reference/step-up-authentication-providers/get.md): Get retrieves a single step-up authentication provider by its ID. - [Update](https://www.c1.ai/docs/api-reference/step-up-authentication-providers/update.md): Update modifies an existing step-up authentication provider's configuration. Use the update mask to specify which fields to change. - [Delete](https://www.c1.ai/docs/api-reference/step-up-authentication-providers/delete.md): Delete removes a step-up authentication provider from the tenant. - [Update Secret](https://www.c1.ai/docs/api-reference/step-up-authentication-providers/update-secret.md): UpdateSecret rotates the client secret for a step-up authentication provider without modifying other settings. - [Test](https://www.c1.ai/docs/api-reference/step-up-authentication-providers/test.md): Test initiates a test authentication flow against a step-up provider and returns a redirect URL for the caller to complete verification. ### Step Up Authentication Transactions - [Search](https://www.c1.ai/docs/api-reference/step-up-authentication-transactions/search.md): Search allows searching for step-up transactions with various filters - [Get](https://www.c1.ai/docs/api-reference/step-up-authentication-transactions/get.md): Get retrieves a specific step-up transaction by ID ### System Log Exporter - [Search](https://www.c1.ai/docs/api-reference/system-log-exporter/search.md): Search for system log exports matching the specified filters. - [List](https://www.c1.ai/docs/api-reference/system-log-exporter/list.md): List Exports. - [Create](https://www.c1.ai/docs/api-reference/system-log-exporter/create.md): Create a system log export. - [Get](https://www.c1.ai/docs/api-reference/system-log-exporter/get.md): Get a system log export by ID - [Update](https://www.c1.ai/docs/api-reference/system-log-exporter/update.md): Update a system log export by providing an export object and an update mask. - [Delete](https://www.c1.ai/docs/api-reference/system-log-exporter/delete.md): Delete a system log export by ID. - [List Events](https://www.c1.ai/docs/api-reference/system-log-exporter/list-events.md): List audit events belonging to a specific system log export. ### Tool Gates - [Search](https://www.c1.ai/docs/api-reference/tool-gates/search.md): Search returns tool gates matching the query, paginated. - [List](https://www.c1.ai/docs/api-reference/tool-gates/list.md): List returns tool gates for the tenant, paginated. - [Create](https://www.c1.ai/docs/api-reference/tool-gates/create.md): Create creates a tool gate. - [Get](https://www.c1.ai/docs/api-reference/tool-gates/get.md): Get returns a tool gate by ID. - [Update](https://www.c1.ai/docs/api-reference/tool-gates/update.md): Update modifies a tool gate's mutable fields. - [Delete](https://www.c1.ai/docs/api-reference/tool-gates/delete.md): Delete removes a tool gate by ID. ### User - [Search](https://www.c1.ai/docs/api-reference/user/search.md): Search users based on filters specified in the request body. - [List](https://www.c1.ai/docs/api-reference/user/list.md): List users. - [Get](https://www.c1.ai/docs/api-reference/user/get.md): Get a user by ID. - [Get User Profile Types](https://www.c1.ai/docs/api-reference/user/get-user-profile-types.md): Retrieve the profile types associated with a user across their connected apps. - [Set Expiring User Delegation Binding By Admin](https://www.c1.ai/docs/api-reference/user/set-expiring-user-delegation-binding-by-admin.md): Set or update an expiring delegation binding for a user, allowing an admin to designate a temporary delegate. - [Introspect](https://www.c1.ai/docs/api-reference/user/introspect.md): Introspect returns the calling user's full UserView (profile, manager, attributes) resolved from the passport on the request. ### Webhook - [Search](https://www.c1.ai/docs/api-reference/webhook/search.md): Search for webhook subscriptions by query string or specific webhook references. - [List](https://www.c1.ai/docs/api-reference/webhook/list.md): List all webhook subscriptions in the tenant, with pagination. - [Create](https://www.c1.ai/docs/api-reference/webhook/create.md): Create a new webhook subscription to receive event notifications at the specified URL. - [Get](https://www.c1.ai/docs/api-reference/webhook/get.md): Retrieve a single webhook by its ID. - [Update](https://www.c1.ai/docs/api-reference/webhook/update.md): Update an existing webhook subscription's properties, such as its URL or display name. - [Delete](https://www.c1.ai/docs/api-reference/webhook/delete.md): Delete a webhook subscription, stopping all future event deliveries to its URL. - [Test](https://www.c1.ai/docs/api-reference/webhook/test.md): Send a sample event to the webhook URL to verify that the endpoint is reachable and responding correctly. ### Service Principal - [List](https://www.c1.ai/docs/api-reference/service-principal/list.md): List lists service principals for the tenant. - [Create](https://www.c1.ai/docs/api-reference/service-principal/create.md): Create creates a new service principal. - [Get](https://www.c1.ai/docs/api-reference/service-principal/get.md): Get returns a service principal by ID. - [Delete](https://www.c1.ai/docs/api-reference/service-principal/delete.md): Delete deletes a service principal and all its credentials. - [Update](https://www.c1.ai/docs/api-reference/service-principal/update.md): Update updates a service principal's display name. - [List Credentials](https://www.c1.ai/docs/api-reference/service-principal/list-credentials.md): ListCredentials lists client credentials for a service principal. - [Create Credential](https://www.c1.ai/docs/api-reference/service-principal/create-credential.md): CreateCredential creates a new client credential for a service principal. - [Get Credential](https://www.c1.ai/docs/api-reference/service-principal/get-credential.md): GetCredential returns a single client credential for a service principal. - [Revoke Credential](https://www.c1.ai/docs/api-reference/service-principal/revoke-credential.md): RevokeCredential revokes (deletes) a client credential for a service principal. - [Update Credential](https://www.c1.ai/docs/api-reference/service-principal/update-credential.md): UpdateCredential updates a client credential for a service principal. ### Service Principal Binding - [Add Binding](https://www.c1.ai/docs/api-reference/service-principal-binding/add-binding.md): AddBinding associates a tenant-scoped subject with an existing service principal. Subjects support zero-to-many bindings; the same pair is idempotent and a soft-deleted pair is restored. Associations do not define runtime identity selection. Requires SERVICE_PRINCIPALS and the subject's feature… - [Delete Binding](https://www.c1.ai/docs/api-reference/service-principal-binding/delete-binding.md): DeleteBinding removes a single (subject, service_principal_id) binding row. At-most-one delete — does not touch other bindings the subject may hold against different service principals. Idempotent — succeeds even if no matching row exists. - [List Bindings](https://www.c1.ai/docs/api-reference/service-principal-binding/list-bindings.md): ListBindings returns every active binding held by a subject. Empty list when the subject is unbound. The response is unordered. ### AI Governance Settings - [Get](https://www.c1.ai/docs/api-reference/ai-governance-settings/get.md): Get the tenant's AI governance settings — the controls behind the admin /admin/settings/ai-governance page. Returns the full AIGovernanceSettings: allowed MCP client types, default client lifecycle, default tool classification, audit verbosity, auto-discovery toggle + interval, prefer_code_mode_… - [Update](https://www.c1.ai/docs/api-reference/ai-governance-settings/update.md): Update the tenant's AI governance settings. Requires update_mask listing which fields to apply (e.g. default_tool_classification, audit_verbosity, auto_discovery_enabled, discovery_interval, prefer_code_mode_over_direct_tools, surface_requestable_tools, untrusted_judge_disable, allowed_client_ty… - [Get Agent Classifier Policy](https://www.c1.ai/docs/api-reference/ai-governance-settings/get-agent-classifier-policy.md): Get returns the tenant's classifier policy with its ordered rules. A tenant that has never written a policy receives an empty policy. - [Update Agent Classifier Policy](https://www.c1.ai/docs/api-reference/ai-governance-settings/update-agent-classifier-policy.md): Update replaces the policy fields named in update_mask. When `rules` is in the mask, the supplied list replaces the entire ordered cascade; rules without an ID receive one, and the policy is materialized on first write. - [List History](https://www.c1.ai/docs/api-reference/ai-governance-settings/list-history.md): List the change history for AI governance settings (newest first). Singleton: scoped to the caller's tenant. Admin-tier per object-history convention. - [Get Tenant Defaults](https://www.c1.ai/docs/api-reference/ai-governance-settings/get-tenant-defaults.md): Get the legacy tenant-default subset of AI governance settings. ### AWS External ID Settings - [Get](https://www.c1.ai/docs/api-reference/aws-external-id-settings/get.md): Get retrieves the AWS external ID for the tenant, used in IAM role trust policies for AWS connectors. ### Contacts - [Get Contacts](https://www.c1.ai/docs/api-reference/contacts/get-contacts.md): GetContacts returns the organization's security, billing, and operations contact email addresses. - [Update Contacts](https://www.c1.ai/docs/api-reference/contacts/update-contacts.md): UpdateContacts updates the organization's security, billing, and operations contact email addresses. If update_mask is set, only the selected fields are changed; otherwise all contact fields are replaced with the values in the request. ### User Developer Preferences - [Get](https://www.c1.ai/docs/api-reference/user-developer-preferences/get.md): Get returns the calling user's developer preferences. Returns the zero value (all preferences off) for users who have never updated them. - [Update](https://www.c1.ai/docs/api-reference/user-developer-preferences/update.md): Update modifies the calling user's developer preferences. See the service-level comment for cluster-merge semantics. ### Org Domain - [List](https://www.c1.ai/docs/api-reference/org-domain/list.md): List returns all verified domains configured for the tenant. - [Update](https://www.c1.ai/docs/api-reference/org-domain/update.md): Update replaces the tenant's set of verified domains with the provided list. ### Tenant Email Provider - [Get Email Capabilities](https://www.c1.ai/docs/api-reference/tenant-email-provider/get-email-capabilities.md): GetEmailCapabilities returns a lightweight summary of email capabilities for the current tenant. Intended for non-admin users (automation builders, secret sharers) to check if external email is available without exposing provider configuration details. - [Get](https://www.c1.ai/docs/api-reference/tenant-email-provider/get.md): Get retrieves the current tenant email provider configuration. - [Update](https://www.c1.ai/docs/api-reference/tenant-email-provider/update.md): Update creates or updates the tenant email provider configuration. - [Search Audit Events](https://www.c1.ai/docs/api-reference/tenant-email-provider/search-audit-events.md): SearchAuditEvents returns email audit events for the tenant. - [Test](https://www.c1.ai/docs/api-reference/tenant-email-provider/test.md): Test sends a test email to verify the provider configuration works end-to-end. ### Identity Policy Defaults - [Get](https://www.c1.ai/docs/api-reference/identity-policy-defaults/get.md): Get returns the tenant's default identity policies. - [Update](https://www.c1.ai/docs/api-reference/identity-policy-defaults/update.md): Update changes the tenant's default identity policies. Supply the defaults object and an update mask listing the fields to change; omitted fields are left as-is. ### Org Notification Settings - [Get](https://www.c1.ai/docs/api-reference/org-notification-settings/get.md): Get retrieves the organization-level notification settings, including per-channel preferences and admin-locked defaults. - [Update](https://www.c1.ai/docs/api-reference/org-notification-settings/update.md): Update modifies the organization-level notification settings, such as enabling channels and locking preferences for users. ### User Notification Settings - [Get](https://www.c1.ai/docs/api-reference/user-notification-settings/get.md): Get retrieves the calling user's notification preferences, merged with organization-level defaults. - [Update](https://www.c1.ai/docs/api-reference/user-notification-settings/update.md): Update modifies the calling user's personal notification preferences for each channel. ### Onboarding Settings - [Get](https://www.c1.ai/docs/api-reference/onboarding-settings/get.md): Get retrieves the current onboarding progress for the tenant. - [Update](https://www.c1.ai/docs/api-reference/onboarding-settings/update.md): Update modifies the onboarding progress, such as marking steps complete or dismissing the wizard. ### Request Settings - [Get](https://www.c1.ai/docs/api-reference/request-settings/get.md): Get returns the tenant's access-request settings. - [Update](https://www.c1.ai/docs/api-reference/request-settings/update.md): Update modifies the tenant's access-request settings. ### Session Settings - [Get](https://www.c1.ai/docs/api-reference/session-settings/get.md): Get retrieves the current session security settings for the tenant. - [Update](https://www.c1.ai/docs/api-reference/session-settings/update.md): Update modifies the session security settings for the tenant, such as session length and IP allowlists. - [Test Source Ip](https://www.c1.ai/docs/api-reference/session-settings/test-source-ip.md): TestSourceIP checks whether a given IP address would be allowed by the specified CIDR allowlist rules. ### Spend Insights - [Get Attribution Rollups](https://www.c1.ai/docs/api-reference/spend-insights/get-attribution-rollups.md): Get ranked settled-spend attribution groups for one dimension and time window. - [Get Denial](https://www.c1.ai/docs/api-reference/spend-insights/get-denial.md): Get one budget-denial episode by its unique ID. - [Search Denials](https://www.c1.ai/docs/api-reference/spend-insights/search-denials.md): Search budget-denial episodes for the organization within a time window. Requires the denial-read permission. - [Resolve Effective Limits](https://www.c1.ai/docs/api-reference/spend-insights/resolve-effective-limits.md): Resolve the budget limits and current usage that apply to a user. Optionally includes application-specific limits. - [Get My Spend Forecast](https://www.c1.ai/docs/api-reference/spend-insights/get-my-spend-forecast.md): Get the caller's forecast for settled AI spend through the current calendar month. - [Get My Spend History](https://www.c1.ai/docs/api-reference/spend-insights/get-my-spend-history.md): Get the caller's settled AI spend history and current calendar-month totals. - [Get My Spend Status](https://www.c1.ai/docs/api-reference/spend-insights/get-my-spend-status.md): Get the caller's budget limits and current usage. An optional denial ID includes that denial only when it is visible to the caller. - [Search My Spend Usage](https://www.c1.ai/docs/api-reference/spend-insights/search-my-spend-usage.md): Search the caller's retained, finalized AI calls. This is not an organization report or a provider invoice. - [Get Overview](https://www.c1.ai/docs/api-reference/spend-insights/get-overview.md): Get an organization-wide spend overview for a requested time window. Returns current budget headroom, trends, forecasts, usage coverage, and denials. ### System Log - [List Events](https://www.c1.ai/docs/api-reference/system-log/list-events.md): ListEvents pulls Events from the ConductorOne system. ### Terraform Export - [Get Schema](https://www.c1.ai/docs/api-reference/terraform-export/get-schema.md): GetSchema returns the field-by-field Terraform mapping for one C1 API object type. Cacheable by (object_fqn, block_kind, provider_version). ### UserAttributeMappings - [List](https://www.c1.ai/docs/api-reference/userattributemappings/list.md): List the user attribute mappings configured for the tenant. Results are sorted within each page, but no ordering is guaranteed across page boundaries. - [Create](https://www.c1.ai/docs/api-reference/userattributemappings/create.md): Create a user attribute mapping. - [Get](https://www.c1.ai/docs/api-reference/userattributemappings/get.md): Get a user attribute mapping by its mapping ID. - [Update](https://www.c1.ai/docs/api-reference/userattributemappings/update.md): Update a user attribute mapping by its mapping ID. The display name and app user profile attribute key are derived from attribute_type. Profile type bindings are updated only when update_mask contains profile_type_ids. - [Delete](https://www.c1.ai/docs/api-reference/userattributemappings/delete.md): Delete a user attribute mapping by its mapping ID. - [List Attribute Types](https://www.c1.ai/docs/api-reference/userattributemappings/list-attribute-types.md): List the well-known and custom user attribute types available for configuring mappings. ### Vault - [Create](https://www.c1.ai/docs/api-reference/vault/create.md): Create provisions a new external secret storage vault and returns it. - [Get](https://www.c1.ai/docs/api-reference/vault/get.md): Get returns a single vault by its ID. - [Update](https://www.c1.ai/docs/api-reference/vault/update.md): Update modifies an existing vault's properties using a field mask. - [Delete](https://www.c1.ai/docs/api-reference/vault/delete.md): Delete a vault by its ID. Active connectors using this vault will no longer be able to access their stored credentials. ### Connector Owner V2 - [Set](https://www.c1.ai/docs/api-reference/connector-owner-v2/set.md): Set replaces all owners for a given connector and role. - [Search Entitlement Owners](https://www.c1.ai/docs/api-reference/connector-owner-v2/search-entitlement-owners.md): SearchEntitlementOwners searches for entitlement ownership sources for a connector. - [Get Entitlement Owner](https://www.c1.ai/docs/api-reference/connector-owner-v2/get-entitlement-owner.md): GetEntitlementOwner gets an entitlement ownership source for a connector. - [Create Entitlement Owner](https://www.c1.ai/docs/api-reference/connector-owner-v2/create-entitlement-owner.md): CreateEntitlementOwner creates an entitlement ownership source for a connector. - [Delete Entitlement Owner](https://www.c1.ai/docs/api-reference/connector-owner-v2/delete-entitlement-owner.md): DeleteEntitlementOwner deletes an entitlement ownership source for a connector. - [Search User Owners](https://www.c1.ai/docs/api-reference/connector-owner-v2/search-user-owners.md): SearchUserOwners searches for user ownership sources for a connector. - [Get User Owner](https://www.c1.ai/docs/api-reference/connector-owner-v2/get-user-owner.md): GetUserOwner gets a user ownership source for a connector. - [Create User Owner](https://www.c1.ai/docs/api-reference/connector-owner-v2/create-user-owner.md): CreateUserOwner creates a user ownership source for a connector. - [Delete User Owner](https://www.c1.ai/docs/api-reference/connector-owner-v2/delete-user-owner.md): DeleteUserOwner deletes a user ownership source for a connector. ### App Entitlement Owner V2 - [Set](https://www.c1.ai/docs/api-reference/app-entitlement-owner-v2/set.md): Set replaces all owners for a given app entitlement and role. - [Search Entitlement Owners](https://www.c1.ai/docs/api-reference/app-entitlement-owner-v2/search-entitlement-owners.md): SearchEntitlementOwners searches for entitlement ownership sources for an app entitlement. - [Get Entitlement Owner](https://www.c1.ai/docs/api-reference/app-entitlement-owner-v2/get-entitlement-owner.md): GetEntitlementOwner gets an entitlement ownership source for an app entitlement. - [Create Entitlement Owner](https://www.c1.ai/docs/api-reference/app-entitlement-owner-v2/create-entitlement-owner.md): CreateEntitlementOwner creates an entitlement ownership source for an app entitlement. - [Delete Entitlement Owner](https://www.c1.ai/docs/api-reference/app-entitlement-owner-v2/delete-entitlement-owner.md): DeleteEntitlementOwner deletes an entitlement ownership source for an app entitlement. - [Search User Owners](https://www.c1.ai/docs/api-reference/app-entitlement-owner-v2/search-user-owners.md): SearchUserOwners searches for user ownership sources of this app entitlement. - [Get User Owner](https://www.c1.ai/docs/api-reference/app-entitlement-owner-v2/get-user-owner.md): GetUserOwner gets a user ownership source for an app entitlement. - [Create User Owner](https://www.c1.ai/docs/api-reference/app-entitlement-owner-v2/create-user-owner.md): CreateUserOwner creates a user ownership source for an app entitlement. - [Delete User Owner](https://www.c1.ai/docs/api-reference/app-entitlement-owner-v2/delete-user-owner.md): DeleteUserOwner deletes a user ownership source for an app entitlement. ### App Owner V2 - [Set](https://www.c1.ai/docs/api-reference/app-owner-v2/set.md): Set replaces all user owners for a given app and role. - [Search Entitlement Owners](https://www.c1.ai/docs/api-reference/app-owner-v2/search-entitlement-owners.md): SearchEntitlementOwners searches for entitlement ownership sources for an app. - [Get Entitlement Owner](https://www.c1.ai/docs/api-reference/app-owner-v2/get-entitlement-owner.md): GetEntitlementOwner gets an entitlement ownership source for an app. - [Create Entitlement Owner](https://www.c1.ai/docs/api-reference/app-owner-v2/create-entitlement-owner.md): CreateEntitlementOwner creates an entitlement ownership source for an app. - [Delete Entitlement Owner](https://www.c1.ai/docs/api-reference/app-owner-v2/delete-entitlement-owner.md): DeleteEntitlementOwner deletes an entitlement ownership source for an app. - [Search User Owners](https://www.c1.ai/docs/api-reference/app-owner-v2/search-user-owners.md): SearchUserOwners searches for user ownership sources for an app. - [Get User Owner](https://www.c1.ai/docs/api-reference/app-owner-v2/get-user-owner.md): GetUserOwner gets a user ownership source for an app. - [Create User Owner](https://www.c1.ai/docs/api-reference/app-owner-v2/create-user-owner.md): CreateUserOwner creates a user ownership source for an app. - [Delete User Owner](https://www.c1.ai/docs/api-reference/app-owner-v2/delete-user-owner.md): DeleteUserOwner deletes a user ownership source for an app. ### App Resource Owner V2 - [Set](https://www.c1.ai/docs/api-reference/app-resource-owner-v2/set.md): Set replaces all owners for a given app resource and role. - [Search Entitlement Owners](https://www.c1.ai/docs/api-reference/app-resource-owner-v2/search-entitlement-owners.md): SearchEntitlementOwners searches for entitlement ownership sources of this app resource. - [Get Entitlement Owner](https://www.c1.ai/docs/api-reference/app-resource-owner-v2/get-entitlement-owner.md): GetEntitlementOwner gets an entitlement ownership source for an app resource. - [Create Entitlement Owner](https://www.c1.ai/docs/api-reference/app-resource-owner-v2/create-entitlement-owner.md): CreateEntitlementOwner creates an entitlement ownership source for an app resource. - [Delete Entitlement Owner](https://www.c1.ai/docs/api-reference/app-resource-owner-v2/delete-entitlement-owner.md): DeleteEntitlementOwner deletes an entitlement ownership source for an app resource. - [Search User Owners](https://www.c1.ai/docs/api-reference/app-resource-owner-v2/search-user-owners.md): SearchUserOwners searches for user ownership sources of this app resource. - [Get User Owner](https://www.c1.ai/docs/api-reference/app-resource-owner-v2/get-user-owner.md): GetUserOwner gets a user ownership source for an app resource. - [Create User Owner](https://www.c1.ai/docs/api-reference/app-resource-owner-v2/create-user-owner.md): CreateUserOwner creates a user ownership source for an app resource. - [Delete User Owner](https://www.c1.ai/docs/api-reference/app-resource-owner-v2/delete-user-owner.md): DeleteUserOwner deletes a user ownership source for an app resource. ### App User Owner V2 - [Set](https://www.c1.ai/docs/api-reference/app-user-owner-v2/set.md): Set replaces all owners for a given app user and role. - [Search Entitlement Owners](https://www.c1.ai/docs/api-reference/app-user-owner-v2/search-entitlement-owners.md): SearchEntitlementOwners searches for entitlement ownership sources of this app user. - [Create Entitlement Owner](https://www.c1.ai/docs/api-reference/app-user-owner-v2/create-entitlement-owner.md): CreateEntitlementOwner creates an entitlement ownership source for an app user. - [Delete Entitlement Owner](https://www.c1.ai/docs/api-reference/app-user-owner-v2/delete-entitlement-owner.md): DeleteEntitlementOwner deletes an entitlement ownership source for an app user. - [Search User Owners](https://www.c1.ai/docs/api-reference/app-user-owner-v2/search-user-owners.md): SearchUserOwners searches for user ownership sources of this app user. - [Create User Owner](https://www.c1.ai/docs/api-reference/app-user-owner-v2/create-user-owner.md): CreateUserOwner creates a user ownership source for an app user. - [Delete User Owner](https://www.c1.ai/docs/api-reference/app-user-owner-v2/delete-user-owner.md): DeleteUserOwner deletes a user ownership source for an app user. ### User Owner V2 - [Set](https://www.c1.ai/docs/api-reference/user-owner-v2/set.md): Set replaces all owners for a given user (service account) and role. - [Search Entitlement Owners](https://www.c1.ai/docs/api-reference/user-owner-v2/search-entitlement-owners.md): SearchEntitlementOwners searches for entitlement ownership sources of this user (service account). - [Create Entitlement Owner](https://www.c1.ai/docs/api-reference/user-owner-v2/create-entitlement-owner.md): CreateEntitlementOwner creates an entitlement ownership source for a user (service account). - [Delete Entitlement Owner](https://www.c1.ai/docs/api-reference/user-owner-v2/delete-entitlement-owner.md): DeleteEntitlementOwner deletes an entitlement ownership source for a user (service account). - [Search User Owners](https://www.c1.ai/docs/api-reference/user-owner-v2/search-user-owners.md): SearchUserOwners searches for user ownership sources of this user (service account). - [Create User Owner](https://www.c1.ai/docs/api-reference/user-owner-v2/create-user-owner.md): CreateUserOwner creates a user ownership source for a user (service account). - [Delete User Owner](https://www.c1.ai/docs/api-reference/user-owner-v2/delete-user-owner.md): DeleteUserOwner deletes a user ownership source for a user (service account). ## OpenAPI Specs - [my-source-with-code-samples](https://spec.speakeasy.com/conductor-one/conductorone/my-source-with-code-samples)