> ## Documentation Index > Fetch the complete documentation index at: https://www.c1.ai/docs/llms.txt > Use this file to discover all available pages before exploring further. # Set Scope And Excluded Entitlements > SetScopeAndExcludedEntitlements replaces the scope configuration and the set of excluded entitlements for a user-first campaign template. Each call replaces the whole excluded set; to add or remove individual entitlements, use AddDeleteExcludedEntitlements instead. Exclusions only take effect for user-first templates (scope type ACCESS_REVIEW_SCOPE_TYPE_BY_USERS). Read the current exclusions back with GetScopeAndEntitlements. ## OpenAPI ````yaml https://spec.speakeasy.com/conductor-one/conductorone/my-source-with-code-samples post /api/v1/access_review_template/{access_review_template_id}/scope_and_excluded_entitlements openapi: 3.1.0 info: description: The C1 API is a HTTP API for managing C1 resources. title: C1 API version: 0.1.0-alpha servers: - description: The C1 API server for the current tenant. url: https://{tenantDomain}.conductor.one variables: tenantDomain: default: example description: The domain of the tenant to use for this request. security: - bearerAuth: [] oauth: [] paths: /api/v1/access_review_template/{access_review_template_id}/scope_and_excluded_entitlements: post: tags: - Access Review Templates summary: Set Scope And Excluded Entitlements description: >- SetScopeAndExcludedEntitlements replaces the scope configuration and the set of excluded entitlements for a user-first campaign template. Each call replaces the whole excluded set; to add or remove individual entitlements, use AddDeleteExcludedEntitlements instead. Exclusions only take effect for user-first templates (scope type ACCESS_REVIEW_SCOPE_TYPE_BY_USERS). Read the current exclusions back with GetScopeAndEntitlements. operationId: >- c1.api.accessreview.v1.AccessReviewTemplateSetupEntitlementService.SetScopeAndExcludedEntitlements parameters: - in: path name: access_review_template_id required: true schema: description: The ID of the user-first access review template to configure. type: string requestBody: content: application/json: schema: $ref: >- #/components/schemas/c1.api.accessreview.v1.AccessReviewSetTemplateScopeAndExcludedEntitlementsRequestInput responses: '200': content: application/json: schema: $ref: >- #/components/schemas/c1.api.accessreview.v1.AccessReviewSetTemplateScopeAndExcludedEntitlementsResponse description: >- AccessReviewSetTemplateScopeAndExcludedEntitlementsResponse contains the resulting excluded entitlements and scope. components: schemas: c1.api.accessreview.v1.AccessReviewSetTemplateScopeAndExcludedEntitlementsRequestInput: description: >- AccessReviewSetTemplateScopeAndExcludedEntitlementsRequest replaces a user-first template's scope and excluded entitlements. To mark the excluded entitlements as the active exclusion type, scope must set excluded_specific_resources. properties: excludedEntitlements: description: >- The entitlements to exclude from scope. Replaces all previously excluded entitlements. items: $ref: >- #/components/schemas/c1.api.accessreview.v1.AccessReviewExcludedEntitlementInput type: - array - 'null' scope: oneOf: - $ref: '#/components/schemas/c1.api.accessreview.v1.AccessReviewScopeV2' - type: 'null' title: Access Review Set Template Scope And Excluded Entitlements Request type: object x-speakeasy-name-override: AccessReviewSetTemplateScopeAndExcludedEntitlementsRequest c1.api.accessreview.v1.AccessReviewSetTemplateScopeAndExcludedEntitlementsResponse: description: >- AccessReviewSetTemplateScopeAndExcludedEntitlementsResponse contains the resulting excluded entitlements and scope. properties: excludedEntitlements: description: The current entitlements excluded from scope. items: $ref: >- #/components/schemas/c1.api.accessreview.v1.AccessReviewTemplateExcludedEntitlement type: - array - 'null' scope: oneOf: - $ref: '#/components/schemas/c1.api.accessreview.v1.AccessReviewScopeV2' - type: 'null' title: Access Review Set Template Scope And Excluded Entitlements Response type: object x-speakeasy-name-override: AccessReviewSetTemplateScopeAndExcludedEntitlementsResponse c1.api.accessreview.v1.AccessReviewExcludedEntitlementInput: description: Identifies an entitlement to exclude from a user-first campaign's scope. properties: appEntitlementId: description: The ID of the entitlement to exclude. type: string appId: description: The ID of the application that owns the entitlement. type: string title: Access Review Excluded Entitlement Input type: object x-speakeasy-name-override: AccessReviewExcludedEntitlementInput c1.api.accessreview.v1.AccessReviewScopeV2: description: > The AccessReviewScopeV2 message. This message contains a oneof named apps_and_resources_scope. Only a single field of the following list may be set at a time: - appAccess - specificResources - appSelectionCriteria - resourceTypeSelections This message contains a oneof named users_scope. Only a single field of the following list may be set at a time: - allUsers - selectedUsers - userCriteria - celExpression This message contains a oneof named accounts_scope. Only a single field of the following list may be set at a time: - allAccounts - accountCriteria - accountCelExpression This message contains a oneof named grants_scope. Only a single field of the following list may be set at a time: - allGrants - grantsByCriteria This message contains a oneof named access_conflicts_scope. Only a single field of the following list may be set at a time: - allAccessConflicts - specificAccessConflicts This message contains a oneof named resource_scope. Only a single field of the following list may be set at a time: - resourceSelection This message contains a oneof named excluded_apps_and_resources_scope. Only a single field of the following list may be set at a time: - excludedSpecificResources - excludedResourceTypeSelections - excludedAppSelectionCriteria This message contains a oneof named access_profiles_scope. Only a single field of the following list may be set at a time: - specificAccessProfiles properties: accessProfileReviewDimensions: oneOf: - $ref: >- #/components/schemas/c1.api.accessreview.v1.AccessProfileReviewDimensions - type: 'null' accountCelExpression: oneOf: - $ref: '#/components/schemas/c1.api.accessreview.v1.CelExpressionScope' - type: 'null' accountCriteria: oneOf: - $ref: '#/components/schemas/c1.api.accessreview.v1.AccountCriteriaScope' - type: 'null' allAccessConflicts: oneOf: - $ref: >- #/components/schemas/c1.api.accessreview.v1.AllAccessConflictsScope - type: 'null' allAccounts: oneOf: - $ref: '#/components/schemas/c1.api.accessreview.v1.AllAccountsScope' - type: 'null' allGrants: oneOf: - $ref: '#/components/schemas/c1.api.accessreview.v1.AllGrantsScope' - type: 'null' allUsers: oneOf: - $ref: '#/components/schemas/c1.api.accessreview.v1.AllUsersScope' - type: 'null' appAccess: oneOf: - $ref: >- #/components/schemas/c1.api.accessreview.v1.ApplicationAccessScope - type: 'null' appSelectionCriteria: oneOf: - $ref: >- #/components/schemas/c1.api.accessreview.v1.AppSelectionCriteriaScope - type: 'null' celExpression: oneOf: - $ref: '#/components/schemas/c1.api.accessreview.v1.CelExpressionScope' - type: 'null' excludedAppSelectionCriteria: oneOf: - $ref: >- #/components/schemas/c1.api.accessreview.v1.AppSelectionCriteriaScope - type: 'null' excludedResourceTypeSelections: oneOf: - $ref: >- #/components/schemas/c1.api.accessreview.v1.ResourceTypeSelectionScope - type: 'null' excludedSpecificResources: oneOf: - $ref: >- #/components/schemas/c1.api.accessreview.v1.SpecificResourcesScope - type: 'null' grantsByCriteria: oneOf: - $ref: >- #/components/schemas/c1.api.accessreview.v1.GrantsByCriteriaScope - type: 'null' principalTypeFilter: description: >- Filters principals included in the scope. Unspecified is treated as users. enum: - PRINCIPAL_TYPE_FILTER_UNSPECIFIED - PRINCIPAL_TYPE_FILTER_USERS - PRINCIPAL_TYPE_FILTER_RESOURCES - PRINCIPAL_TYPE_FILTER_USERS_AND_RESOURCES type: string x-speakeasy-unknown-values: allow resourceSelection: oneOf: - $ref: >- #/components/schemas/c1.api.accessreview.v1.ResourceSelectionScope - type: 'null' resourceTypeSelections: oneOf: - $ref: >- #/components/schemas/c1.api.accessreview.v1.ResourceTypeSelectionScope - type: 'null' scopeRoleSelection: oneOf: - $ref: >- #/components/schemas/c1.api.accessreview.v1.ScopeRoleSelectionScope - type: 'null' selectedUsers: oneOf: - $ref: '#/components/schemas/c1.api.accessreview.v1.SelectedUsersScope' - type: 'null' specificAccessConflicts: oneOf: - $ref: >- #/components/schemas/c1.api.accessreview.v1.SpecificAccessConflictsScope - type: 'null' specificAccessProfiles: oneOf: - $ref: >- #/components/schemas/c1.api.accessreview.v1.SpecificAccessProfilesScope - type: 'null' specificResources: oneOf: - $ref: >- #/components/schemas/c1.api.accessreview.v1.SpecificResourcesScope - type: 'null' userCriteria: oneOf: - $ref: '#/components/schemas/c1.api.accessreview.v1.UserCriteriaScope' - type: 'null' title: Access Review Scope V 2 type: object x-speakeasy-name-override: AccessReviewScopeV2 c1.api.accessreview.v1.AccessReviewTemplateExcludedEntitlement: description: >- An entitlement excluded from a user-first access review template's scope. properties: accessReviewTemplateId: description: The ID of the access review template this exclusion belongs to. type: string appEntitlementId: description: The ID of the entitlement excluded from scope. type: string appId: description: The ID of the application that owns the entitlement. type: string appResourceId: description: >- The ID of the specific resource associated with this entitlement, if applicable. type: string appResourceTypeId: description: >- The ID of the resource type associated with this entitlement, if applicable. type: string createdAt: format: date-time readOnly: true type: - string - 'null' deletedAt: format: date-time readOnly: true type: - string - 'null' tenantId: description: The tenant that owns this exclusion. type: string updatedAt: format: date-time readOnly: true type: - string - 'null' title: Access Review Template Excluded Entitlement type: object x-speakeasy-name-override: AccessReviewTemplateExcludedEntitlement c1.api.accessreview.v1.AccessProfileReviewDimensions: description: >- Review dimensions an access-profile campaign covers. At least one is expected. properties: composition: description: The composition field. type: boolean membershipCriteria: description: The membershipCriteria field. type: boolean membershipExceptions: description: The membershipExceptions field. type: boolean title: Access Profile Review Dimensions type: object x-speakeasy-name-override: AccessProfileReviewDimensions c1.api.accessreview.v1.CelExpressionScope: description: The CelExpressionScope message. properties: expression: description: The expression field. type: string title: Cel Expression Scope type: object x-speakeasy-name-override: CelExpressionScope c1.api.accessreview.v1.AccountCriteriaScope: description: The AccountCriteriaScope message. properties: accountDomain: description: The accountDomain field. enum: - APP_USER_DOMAIN_UNSPECIFIED - APP_USER_DOMAIN_EXTERNAL - APP_USER_DOMAIN_TRUSTED type: string x-speakeasy-unknown-values: allow accountTypes: description: The accountTypes field. items: enum: - APP_USER_TYPE_UNSPECIFIED - APP_USER_TYPE_USER - APP_USER_TYPE_SERVICE_ACCOUNT - APP_USER_TYPE_SYSTEM_ACCOUNT type: string x-speakeasy-unknown-values: allow type: - array - 'null' appUserStatuses: description: The appUserStatuses field. items: enum: - APP_USER_STATUS_UNSPECIFIED - APP_USER_STATUS_ENABLED - APP_USER_STATUS_DISABLED - APP_USER_STATUS_DELETED - APP_USER_STATUS_PENDING type: string x-speakeasy-unknown-values: allow type: - array - 'null' noAccountOwner: description: The noAccountOwner field. type: boolean title: Account Criteria Scope type: object x-speakeasy-name-override: AccountCriteriaScope c1.api.accessreview.v1.AllAccessConflictsScope: description: The AllAccessConflictsScope message. title: All Access Conflicts Scope type: object x-speakeasy-name-override: AllAccessConflictsScope c1.api.accessreview.v1.AllAccountsScope: description: The AllAccountsScope message. title: All Accounts Scope type: object x-speakeasy-name-override: AllAccountsScope c1.api.accessreview.v1.AllGrantsScope: description: The AllGrantsScope message. title: All Grants Scope type: object x-speakeasy-name-override: AllGrantsScope c1.api.accessreview.v1.AllUsersScope: description: The AllUsersScope message. title: All Users Scope type: object x-speakeasy-name-override: AllUsersScope c1.api.accessreview.v1.ApplicationAccessScope: description: The ApplicationAccessScope message. title: Application Access Scope type: object x-speakeasy-name-override: ApplicationAccessScope c1.api.accessreview.v1.AppSelectionCriteriaScope: description: >- Selects entitlements matching every set field; values within a field are alternatives. properties: annotationMatches: description: >- Entitlements whose annotations match at least one entry (exact key and value). Requires app_ids; applies across every selected app. items: $ref: '#/components/schemas/c1.api.app.v1.AnnotationMatch' type: - array - 'null' appIds: description: The appIds field. items: type: string type: - array - 'null' complianceFrameworkAttributeValueIds: description: The complianceFrameworkAttributeValueIds field. items: type: string type: - array - 'null' resourceProfileMatches: description: >- Entitlements whose resource profile matches at least one entry. Requires app_ids; applies across every selected app. items: $ref: '#/components/schemas/c1.api.app.v1.ResourceProfileMatch' type: - array - 'null' resourceTypeRefs: description: The resourceTypeRefs field. items: $ref: '#/components/schemas/c1.api.app.v1.ResourceTypeRef' type: - array - 'null' riskLevelAttributeValueIds: description: The riskLevelAttributeValueIds field. items: type: string type: - array - 'null' title: App Selection Criteria Scope type: object x-speakeasy-name-override: AppSelectionCriteriaScope c1.api.accessreview.v1.ResourceTypeSelectionScope: description: The ResourceTypeSelectionScope message. title: Resource Type Selection Scope type: object x-speakeasy-name-override: ResourceTypeSelectionScope c1.api.accessreview.v1.SpecificResourcesScope: description: The SpecificResourcesScope message. title: Specific Resources Scope type: object x-speakeasy-name-override: SpecificResourcesScope c1.api.accessreview.v1.GrantsByCriteriaScope: description: > The GrantsByCriteriaScope message. This message contains a oneof named criteria_filter. Only a single field of the following list may be set at a time: - daysSinceAdded - daysSinceReviewed - grantsAddedBetween properties: accessProfileFilter: oneOf: - $ref: >- #/components/schemas/c1.api.accessreview.v1.GrantAccessProfileFilter - type: 'null' daysSinceAdded: format: duration type: - string - 'null' daysSinceLastUsed: format: duration type: - string - 'null' daysSinceReviewed: format: duration type: - string - 'null' grantsAddedBetween: oneOf: - $ref: '#/components/schemas/c1.api.accessreview.v1.GrantsAddedBetween' - type: 'null' sourceFilter: description: The sourceFilter field. enum: - GRANT_SOURCE_FILTER_UNSPECIFIED - GRANT_SOURCE_FILTER_DIRECT - GRANT_SOURCE_FILTER_INHERITED type: string x-speakeasy-unknown-values: allow typeFilter: description: The typeFilter field. enum: - GRANT_FILTER_TYPE_UNSPECIFIED - GRANT_FILTER_TYPE_PERMANENT - GRANT_FILTER_TYPE_TEMPORARY type: string x-speakeasy-unknown-values: allow usedWithinLast: format: duration type: - string - 'null' title: Grants By Criteria Scope type: object x-speakeasy-name-override: GrantsByCriteriaScope c1.api.accessreview.v1.ResourceSelectionScope: description: The ResourceSelectionScope message. title: Resource Selection Scope type: object x-speakeasy-name-override: ResourceSelectionScope c1.api.accessreview.v1.ScopeRoleSelectionScope: description: |- Empty marker for scope+role pair scoping on IaaS-type apps. Actual selections stored in AccessReviewScopeRoleSelection rows. May coexist with ResourceSelectionScope on the same campaign; prepare unions both. title: Scope Role Selection Scope type: object x-speakeasy-name-override: ScopeRoleSelectionScope c1.api.accessreview.v1.SelectedUsersScope: description: The SelectedUsersScope message. properties: userIds: description: The userIds field. items: type: string type: - array - 'null' title: Selected Users Scope type: object x-speakeasy-name-override: SelectedUsersScope c1.api.accessreview.v1.SpecificAccessConflictsScope: description: The SpecificAccessConflictsScope message. title: Specific Access Conflicts Scope type: object x-speakeasy-name-override: SpecificAccessConflictsScope c1.api.accessreview.v1.SpecificAccessProfilesScope: description: |- Empty marker for access-profile scoping. Actual profile selections stored in separate rows keyed by access_review_id. title: Specific Access Profiles Scope type: object x-speakeasy-name-override: SpecificAccessProfilesScope c1.api.accessreview.v1.UserCriteriaScope: description: The UserCriteriaScope message. properties: groupAppEntitlementsRef: description: The groupAppEntitlementsRef field. items: $ref: '#/components/schemas/c1.api.app.v1.AppEntitlementRef' type: - array - 'null' managerUserIds: description: The managerUserIds field. items: type: string type: - array - 'null' multiUserProfileAttributes: additionalProperties: $ref: >- #/components/schemas/c1.api.accessreview.v1.IncludedUserAttributeValues description: The multiUserProfileAttributes field. type: object userStatus: description: The userStatus field. items: enum: - UNKNOWN - ENABLED - DISABLED - DELETED type: string x-speakeasy-unknown-values: allow type: - array - 'null' title: User Criteria Scope type: object x-speakeasy-name-override: UserCriteriaScope c1.api.app.v1.AnnotationMatch: description: >- Matches entitlements whose annotations contain `key` with exactly `value`. properties: key: description: The key field. type: string value: description: >- The full value pattern is enforced server-side by pkg/annotations where criteria are saved. type: string title: Annotation Match type: object x-speakeasy-name-override: AnnotationMatch c1.api.app.v1.ResourceProfileMatch: description: >- Matches entitlements whose resource profile has a top-level `key` whose text form is exactly `value`. properties: key: description: The key field. type: string value: description: The value field. type: string title: Resource Profile Match type: object x-speakeasy-name-override: ResourceProfileMatch c1.api.app.v1.ResourceTypeRef: description: >- Pairs a resource type with the app that defines it. A resource type id (and even its display name) is only unique within its app -- some system-wide types like Credential reuse the same id across every app -- so this is the only way to select one unambiguously. Deliberately not c1.api.app.v1.AppResourceTypeRef (app_resource.proto): app_resource.proto can't be imported here without an import cycle through app_entitlement.proto. That other message is unrelated to this one -- it's a distinct type kept only for its own (unrelated) callers -- so don't reuse it for entitlement/criteria resource-type scoping. properties: appId: description: The appId field. type: string id: description: The id field. type: string title: Resource Type Ref type: object x-speakeasy-name-override: ResourceTypeRef c1.api.accessreview.v1.GrantAccessProfileFilter: description: The GrantAccessProfileFilter message. properties: excludedAccessProfileIds: description: |- Access profile IDs to EXCLUDE from the campaign Used when filter_type = EXCLUDE_SPECIFIC Max 32 profile IDs items: type: string type: - array - 'null' filterType: description: The filterType field. enum: - ACCESS_PROFILE_FILTER_TYPE_UNSPECIFIED - ACCESS_PROFILE_FILTER_TYPE_INCLUDE_ALL - ACCESS_PROFILE_FILTER_TYPE_EXCLUDE_ALL - ACCESS_PROFILE_FILTER_TYPE_EXCLUDE_SPECIFIC - ACCESS_PROFILE_FILTER_TYPE_INCLUDE_SPECIFIC type: string x-speakeasy-unknown-values: allow includedAccessProfileIds: description: |- Access profile IDs to INCLUDE in the campaign Used when filter_type = INCLUDE_SPECIFIC Max 32 profile IDs items: type: string type: - array - 'null' title: Grant Access Profile Filter type: object x-speakeasy-name-override: GrantAccessProfileFilter c1.api.accessreview.v1.GrantsAddedBetween: description: The GrantsAddedBetween message. properties: endDate: format: date-time type: - string - 'null' startDate: format: date-time type: - string - 'null' title: Grants Added Between type: object x-speakeasy-name-override: GrantsAddedBetween c1.api.app.v1.AppEntitlementRef: description: The AppEntitlementRef message. properties: appId: description: The appId field. type: string id: description: The id field. type: string title: App Entitlement Ref type: object x-speakeasy-name-override: AppEntitlementRef c1.api.accessreview.v1.IncludedUserAttributeValues: description: The IncludedUserAttributeValues message. properties: values: description: The values field. items: $ref: >- #/components/schemas/c1.api.accessreview.v1.IncludedUserAttributeValue type: - array - 'null' title: Included User Attribute Values type: object x-speakeasy-name-override: IncludedUserAttributeValues c1.api.accessreview.v1.IncludedUserAttributeValue: description: The IncludedUserAttributeValue message. properties: value: description: The value field. type: string title: Included User Attribute Value type: object x-speakeasy-name-override: IncludedUserAttributeValue securitySchemes: bearerAuth: scheme: bearer type: http oauth: description: >- This API uses OAuth2 with the Client Credential flow. Client Credentials must be sent in the BODY, not the headers. For an example of how to implement this, refer to the [c1TokenSource.Token()](https://github.com/ConductorOne/conductorone-sdk-go/blob/3375fe7c0126d17e7ec4e711693dee7b791023aa/token_source.go#L101-L187) function. flows: clientCredentials: scopes: {} tokenUrl: /auth/v1/token type: oauth2 ````