> ## Documentation Index > Fetch the complete documentation index at: https://www.c1.ai/docs/llms.txt > Use this file to discover all available pages before exploring further. # Set Scope By Excluded Resource Type > SetScopeByExcludedResourceType replaces the scope configuration and the set of excluded resource types for a user-first campaign template. Each call replaces the whole excluded set. Exclusions only take effect for user-first templates (scope type ACCESS_REVIEW_SCOPE_TYPE_BY_USERS). Read the current exclusions back with GetScopeAndEntitlements. This route is superseded and scheduled for removal. Requests that set excluded_resource_types are rejected with FAILED_PRECONDITION; an empty list, which clears stored resource-type exclusions, is still accepted. To exclude entitlements by resource type, call SetScopeAndExcludedEntitlements with scope.excluded_app_selection_criteria and list the resource types in resource_type_refs. ## OpenAPI ````yaml https://spec.speakeasy.com/conductor-one/conductorone/my-source-with-code-samples post /api/v1/access_review_template/{access_review_template_id}/scope_by_excluded_resource_type openapi: 3.1.0 info: description: The C1 API is a HTTP API for managing C1 resources. title: C1 API version: 0.1.0-alpha servers: - description: The C1 API server for the current tenant. url: https://{tenantDomain}.conductor.one variables: tenantDomain: default: example description: The domain of the tenant to use for this request. security: - bearerAuth: [] oauth: [] paths: /api/v1/access_review_template/{access_review_template_id}/scope_by_excluded_resource_type: post: tags: - Access Review Templates summary: Set Scope By Excluded Resource Type description: >- SetScopeByExcludedResourceType replaces the scope configuration and the set of excluded resource types for a user-first campaign template. Each call replaces the whole excluded set. Exclusions only take effect for user-first templates (scope type ACCESS_REVIEW_SCOPE_TYPE_BY_USERS). Read the current exclusions back with GetScopeAndEntitlements. This route is superseded and scheduled for removal. Requests that set excluded_resource_types are rejected with FAILED_PRECONDITION; an empty list, which clears stored resource-type exclusions, is still accepted. To exclude entitlements by resource type, call SetScopeAndExcludedEntitlements with scope.excluded_app_selection_criteria and list the resource types in resource_type_refs. operationId: >- c1.api.accessreview.v1.AccessReviewTemplateSetupEntitlementService.SetScopeByExcludedResourceType parameters: - in: path name: access_review_template_id required: true schema: description: The ID of the user-first access review template to configure. type: string requestBody: content: application/json: schema: $ref: >- #/components/schemas/c1.api.accessreview.v1.AccessReviewSetTemplateScopeByExcludedResourceTypeRequestInput responses: '200': content: application/json: schema: $ref: >- #/components/schemas/c1.api.accessreview.v1.AccessReviewSetTemplateScopeByExcludedResourceTypeResponse description: >- AccessReviewSetTemplateScopeByExcludedResourceTypeResponse contains the resulting excluded resource types and scope. deprecated: true components: schemas: c1.api.accessreview.v1.AccessReviewSetTemplateScopeByExcludedResourceTypeRequestInput: description: >- AccessReviewSetTemplateScopeByExcludedResourceTypeRequest replaces a user-first template's scope and excluded resource types. To mark the excluded resource types as the active exclusion type, scope must set excluded_resource_type_selections. properties: excludedResourceTypes: description: >- The resource types to exclude from scope. Replaces all previously excluded resource types. items: $ref: >- #/components/schemas/c1.api.accessreview.v1.AccessReviewExcludedResourceTypeInput type: - array - 'null' scope: oneOf: - $ref: '#/components/schemas/c1.api.accessreview.v1.AccessReviewScopeV2' - type: 'null' title: Access Review Set Template Scope By Excluded Resource Type Request type: object x-speakeasy-name-override: AccessReviewSetTemplateScopeByExcludedResourceTypeRequest c1.api.accessreview.v1.AccessReviewSetTemplateScopeByExcludedResourceTypeResponse: description: >- AccessReviewSetTemplateScopeByExcludedResourceTypeResponse contains the resulting excluded resource types and scope. properties: excludedResourceTypes: description: The current resource types excluded from scope. items: $ref: >- #/components/schemas/c1.api.accessreview.v1.AccessReviewTemplateExcludedResourceType type: - array - 'null' scope: oneOf: - $ref: '#/components/schemas/c1.api.accessreview.v1.AccessReviewScopeV2' - type: 'null' title: Access Review Set Template Scope By Excluded Resource Type Response type: object x-speakeasy-name-override: AccessReviewSetTemplateScopeByExcludedResourceTypeResponse c1.api.accessreview.v1.AccessReviewExcludedResourceTypeInput: description: >- Identifies a resource type to exclude from a user-first campaign's scope. properties: appId: description: The ID of the application that owns the resource type. type: string resourceTypeId: description: The ID of the resource type to exclude. type: string title: Access Review Excluded Resource Type Input type: object x-speakeasy-name-override: AccessReviewExcludedResourceTypeInput c1.api.accessreview.v1.AccessReviewScopeV2: description: > The AccessReviewScopeV2 message. This message contains a oneof named apps_and_resources_scope. Only a single field of the following list may be set at a time: - appAccess - specificResources - appSelectionCriteria - resourceTypeSelections This message contains a oneof named users_scope. Only a single field of the following list may be set at a time: - allUsers - selectedUsers - userCriteria - celExpression This message contains a oneof named accounts_scope. Only a single field of the following list may be set at a time: - allAccounts - accountCriteria - accountCelExpression This message contains a oneof named grants_scope. Only a single field of the following list may be set at a time: - allGrants - grantsByCriteria This message contains a oneof named access_conflicts_scope. Only a single field of the following list may be set at a time: - allAccessConflicts - specificAccessConflicts This message contains a oneof named resource_scope. Only a single field of the following list may be set at a time: - resourceSelection This message contains a oneof named excluded_apps_and_resources_scope. Only a single field of the following list may be set at a time: - excludedSpecificResources - excludedResourceTypeSelections - excludedAppSelectionCriteria This message contains a oneof named access_profiles_scope. Only a single field of the following list may be set at a time: - specificAccessProfiles properties: accessProfileReviewDimensions: oneOf: - $ref: >- #/components/schemas/c1.api.accessreview.v1.AccessProfileReviewDimensions - type: 'null' accountCelExpression: oneOf: - $ref: '#/components/schemas/c1.api.accessreview.v1.CelExpressionScope' - type: 'null' accountCriteria: oneOf: - $ref: '#/components/schemas/c1.api.accessreview.v1.AccountCriteriaScope' - type: 'null' allAccessConflicts: oneOf: - $ref: >- #/components/schemas/c1.api.accessreview.v1.AllAccessConflictsScope - type: 'null' allAccounts: oneOf: - $ref: '#/components/schemas/c1.api.accessreview.v1.AllAccountsScope' - type: 'null' allGrants: oneOf: - $ref: '#/components/schemas/c1.api.accessreview.v1.AllGrantsScope' - type: 'null' allUsers: oneOf: - $ref: '#/components/schemas/c1.api.accessreview.v1.AllUsersScope' - type: 'null' appAccess: oneOf: - $ref: >- #/components/schemas/c1.api.accessreview.v1.ApplicationAccessScope - type: 'null' appSelectionCriteria: oneOf: - $ref: >- #/components/schemas/c1.api.accessreview.v1.AppSelectionCriteriaScope - type: 'null' celExpression: oneOf: - $ref: '#/components/schemas/c1.api.accessreview.v1.CelExpressionScope' - type: 'null' excludedAppSelectionCriteria: oneOf: - $ref: >- #/components/schemas/c1.api.accessreview.v1.AppSelectionCriteriaScope - type: 'null' excludedResourceTypeSelections: oneOf: - $ref: >- #/components/schemas/c1.api.accessreview.v1.ResourceTypeSelectionScope - type: 'null' excludedSpecificResources: oneOf: - $ref: >- #/components/schemas/c1.api.accessreview.v1.SpecificResourcesScope - type: 'null' grantsByCriteria: oneOf: - $ref: >- #/components/schemas/c1.api.accessreview.v1.GrantsByCriteriaScope - type: 'null' principalTypeFilter: description: >- Filters principals included in the scope. Unspecified is treated as users. enum: - PRINCIPAL_TYPE_FILTER_UNSPECIFIED - PRINCIPAL_TYPE_FILTER_USERS - PRINCIPAL_TYPE_FILTER_RESOURCES - PRINCIPAL_TYPE_FILTER_USERS_AND_RESOURCES type: string x-speakeasy-unknown-values: allow resourceSelection: oneOf: - $ref: >- #/components/schemas/c1.api.accessreview.v1.ResourceSelectionScope - type: 'null' resourceTypeSelections: oneOf: - $ref: >- #/components/schemas/c1.api.accessreview.v1.ResourceTypeSelectionScope - type: 'null' scopeRoleSelection: oneOf: - $ref: >- #/components/schemas/c1.api.accessreview.v1.ScopeRoleSelectionScope - type: 'null' selectedUsers: oneOf: - $ref: '#/components/schemas/c1.api.accessreview.v1.SelectedUsersScope' - type: 'null' specificAccessConflicts: oneOf: - $ref: >- #/components/schemas/c1.api.accessreview.v1.SpecificAccessConflictsScope - type: 'null' specificAccessProfiles: oneOf: - $ref: >- #/components/schemas/c1.api.accessreview.v1.SpecificAccessProfilesScope - type: 'null' specificResources: oneOf: - $ref: >- #/components/schemas/c1.api.accessreview.v1.SpecificResourcesScope - type: 'null' userCriteria: oneOf: - $ref: '#/components/schemas/c1.api.accessreview.v1.UserCriteriaScope' - type: 'null' title: Access Review Scope V 2 type: object x-speakeasy-name-override: AccessReviewScopeV2 c1.api.accessreview.v1.AccessReviewTemplateExcludedResourceType: description: >- A resource type whose grants are excluded from a user-first access review template's scope. properties: accessReviewTemplateId: description: The ID of the access review template this exclusion belongs to. type: string appId: description: The ID of the application that owns the resource type. type: string createdAt: format: date-time readOnly: true type: - string - 'null' deletedAt: format: date-time readOnly: true type: - string - 'null' resourceTypeId: description: The ID of the resource type excluded from scope. type: string tenantId: description: The tenant that owns this exclusion. type: string updatedAt: format: date-time readOnly: true type: - string - 'null' title: Access Review Template Excluded Resource Type type: object x-speakeasy-name-override: AccessReviewTemplateExcludedResourceType c1.api.accessreview.v1.AccessProfileReviewDimensions: description: >- Review dimensions an access-profile campaign covers. At least one is expected. properties: composition: description: The composition field. type: boolean membershipCriteria: description: The membershipCriteria field. type: boolean membershipExceptions: description: The membershipExceptions field. type: boolean title: Access Profile Review Dimensions type: object x-speakeasy-name-override: AccessProfileReviewDimensions c1.api.accessreview.v1.CelExpressionScope: description: The CelExpressionScope message. properties: expression: description: The expression field. type: string title: Cel Expression Scope type: object x-speakeasy-name-override: CelExpressionScope c1.api.accessreview.v1.AccountCriteriaScope: description: The AccountCriteriaScope message. properties: accountDomain: description: The accountDomain field. enum: - APP_USER_DOMAIN_UNSPECIFIED - APP_USER_DOMAIN_EXTERNAL - APP_USER_DOMAIN_TRUSTED type: string x-speakeasy-unknown-values: allow accountTypes: description: The accountTypes field. items: enum: - APP_USER_TYPE_UNSPECIFIED - APP_USER_TYPE_USER - APP_USER_TYPE_SERVICE_ACCOUNT - APP_USER_TYPE_SYSTEM_ACCOUNT type: string x-speakeasy-unknown-values: allow type: - array - 'null' appUserStatuses: description: The appUserStatuses field. items: enum: - APP_USER_STATUS_UNSPECIFIED - APP_USER_STATUS_ENABLED - APP_USER_STATUS_DISABLED - APP_USER_STATUS_DELETED - APP_USER_STATUS_PENDING type: string x-speakeasy-unknown-values: allow type: - array - 'null' noAccountOwner: description: The noAccountOwner field. type: boolean title: Account Criteria Scope type: object x-speakeasy-name-override: AccountCriteriaScope c1.api.accessreview.v1.AllAccessConflictsScope: description: The AllAccessConflictsScope message. title: All Access Conflicts Scope type: object x-speakeasy-name-override: AllAccessConflictsScope c1.api.accessreview.v1.AllAccountsScope: description: The AllAccountsScope message. title: All Accounts Scope type: object x-speakeasy-name-override: AllAccountsScope c1.api.accessreview.v1.AllGrantsScope: description: The AllGrantsScope message. title: All Grants Scope type: object x-speakeasy-name-override: AllGrantsScope c1.api.accessreview.v1.AllUsersScope: description: The AllUsersScope message. title: All Users Scope type: object x-speakeasy-name-override: AllUsersScope c1.api.accessreview.v1.ApplicationAccessScope: description: The ApplicationAccessScope message. title: Application Access Scope type: object x-speakeasy-name-override: ApplicationAccessScope c1.api.accessreview.v1.AppSelectionCriteriaScope: description: >- Selects entitlements matching every set field; values within a field are alternatives. properties: annotationMatches: description: >- Entitlements whose annotations match at least one entry (exact key and value). Requires app_ids; applies across every selected app. items: $ref: '#/components/schemas/c1.api.app.v1.AnnotationMatch' type: - array - 'null' appIds: description: The appIds field. items: type: string type: - array - 'null' complianceFrameworkAttributeValueIds: description: The complianceFrameworkAttributeValueIds field. items: type: string type: - array - 'null' resourceProfileMatches: description: >- Entitlements whose resource profile matches at least one entry. Requires app_ids; applies across every selected app. items: $ref: '#/components/schemas/c1.api.app.v1.ResourceProfileMatch' type: - array - 'null' resourceTypeRefs: description: The resourceTypeRefs field. items: $ref: '#/components/schemas/c1.api.app.v1.ResourceTypeRef' type: - array - 'null' riskLevelAttributeValueIds: description: The riskLevelAttributeValueIds field. items: type: string type: - array - 'null' title: App Selection Criteria Scope type: object x-speakeasy-name-override: AppSelectionCriteriaScope c1.api.accessreview.v1.ResourceTypeSelectionScope: description: The ResourceTypeSelectionScope message. title: Resource Type Selection Scope type: object x-speakeasy-name-override: ResourceTypeSelectionScope c1.api.accessreview.v1.SpecificResourcesScope: description: The SpecificResourcesScope message. title: Specific Resources Scope type: object x-speakeasy-name-override: SpecificResourcesScope c1.api.accessreview.v1.GrantsByCriteriaScope: description: > The GrantsByCriteriaScope message. This message contains a oneof named criteria_filter. Only a single field of the following list may be set at a time: - daysSinceAdded - daysSinceReviewed - grantsAddedBetween properties: accessProfileFilter: oneOf: - $ref: >- #/components/schemas/c1.api.accessreview.v1.GrantAccessProfileFilter - type: 'null' daysSinceAdded: format: duration type: - string - 'null' daysSinceLastUsed: format: duration type: - string - 'null' daysSinceReviewed: format: duration type: - string - 'null' grantsAddedBetween: oneOf: - $ref: '#/components/schemas/c1.api.accessreview.v1.GrantsAddedBetween' - type: 'null' sourceFilter: description: The sourceFilter field. enum: - GRANT_SOURCE_FILTER_UNSPECIFIED - GRANT_SOURCE_FILTER_DIRECT - GRANT_SOURCE_FILTER_INHERITED type: string x-speakeasy-unknown-values: allow typeFilter: description: The typeFilter field. enum: - GRANT_FILTER_TYPE_UNSPECIFIED - GRANT_FILTER_TYPE_PERMANENT - GRANT_FILTER_TYPE_TEMPORARY type: string x-speakeasy-unknown-values: allow usedWithinLast: format: duration type: - string - 'null' title: Grants By Criteria Scope type: object x-speakeasy-name-override: GrantsByCriteriaScope c1.api.accessreview.v1.ResourceSelectionScope: description: The ResourceSelectionScope message. title: Resource Selection Scope type: object x-speakeasy-name-override: ResourceSelectionScope c1.api.accessreview.v1.ScopeRoleSelectionScope: description: |- Empty marker for scope+role pair scoping on IaaS-type apps. Actual selections stored in AccessReviewScopeRoleSelection rows. May coexist with ResourceSelectionScope on the same campaign; prepare unions both. title: Scope Role Selection Scope type: object x-speakeasy-name-override: ScopeRoleSelectionScope c1.api.accessreview.v1.SelectedUsersScope: description: The SelectedUsersScope message. properties: userIds: description: The userIds field. items: type: string type: - array - 'null' title: Selected Users Scope type: object x-speakeasy-name-override: SelectedUsersScope c1.api.accessreview.v1.SpecificAccessConflictsScope: description: The SpecificAccessConflictsScope message. title: Specific Access Conflicts Scope type: object x-speakeasy-name-override: SpecificAccessConflictsScope c1.api.accessreview.v1.SpecificAccessProfilesScope: description: |- Empty marker for access-profile scoping. Actual profile selections stored in separate rows keyed by access_review_id. title: Specific Access Profiles Scope type: object x-speakeasy-name-override: SpecificAccessProfilesScope c1.api.accessreview.v1.UserCriteriaScope: description: The UserCriteriaScope message. properties: groupAppEntitlementsRef: description: The groupAppEntitlementsRef field. items: $ref: '#/components/schemas/c1.api.app.v1.AppEntitlementRef' type: - array - 'null' managerUserIds: description: The managerUserIds field. items: type: string type: - array - 'null' multiUserProfileAttributes: additionalProperties: $ref: >- #/components/schemas/c1.api.accessreview.v1.IncludedUserAttributeValues description: The multiUserProfileAttributes field. type: object userStatus: description: The userStatus field. items: enum: - UNKNOWN - ENABLED - DISABLED - DELETED type: string x-speakeasy-unknown-values: allow type: - array - 'null' title: User Criteria Scope type: object x-speakeasy-name-override: UserCriteriaScope c1.api.app.v1.AnnotationMatch: description: >- Matches entitlements whose annotations contain `key` with exactly `value`. properties: key: description: The key field. type: string value: description: >- The full value pattern is enforced server-side by pkg/annotations where criteria are saved. type: string title: Annotation Match type: object x-speakeasy-name-override: AnnotationMatch c1.api.app.v1.ResourceProfileMatch: description: >- Matches entitlements whose resource profile has a top-level `key` whose text form is exactly `value`. properties: key: description: The key field. type: string value: description: The value field. type: string title: Resource Profile Match type: object x-speakeasy-name-override: ResourceProfileMatch c1.api.app.v1.ResourceTypeRef: description: >- Pairs a resource type with the app that defines it. A resource type id (and even its display name) is only unique within its app -- some system-wide types like Credential reuse the same id across every app -- so this is the only way to select one unambiguously. Deliberately not c1.api.app.v1.AppResourceTypeRef (app_resource.proto): app_resource.proto can't be imported here without an import cycle through app_entitlement.proto. That other message is unrelated to this one -- it's a distinct type kept only for its own (unrelated) callers -- so don't reuse it for entitlement/criteria resource-type scoping. properties: appId: description: The appId field. type: string id: description: The id field. type: string title: Resource Type Ref type: object x-speakeasy-name-override: ResourceTypeRef c1.api.accessreview.v1.GrantAccessProfileFilter: description: The GrantAccessProfileFilter message. properties: excludedAccessProfileIds: description: |- Access profile IDs to EXCLUDE from the campaign Used when filter_type = EXCLUDE_SPECIFIC Max 32 profile IDs items: type: string type: - array - 'null' filterType: description: The filterType field. enum: - ACCESS_PROFILE_FILTER_TYPE_UNSPECIFIED - ACCESS_PROFILE_FILTER_TYPE_INCLUDE_ALL - ACCESS_PROFILE_FILTER_TYPE_EXCLUDE_ALL - ACCESS_PROFILE_FILTER_TYPE_EXCLUDE_SPECIFIC - ACCESS_PROFILE_FILTER_TYPE_INCLUDE_SPECIFIC type: string x-speakeasy-unknown-values: allow includedAccessProfileIds: description: |- Access profile IDs to INCLUDE in the campaign Used when filter_type = INCLUDE_SPECIFIC Max 32 profile IDs items: type: string type: - array - 'null' title: Grant Access Profile Filter type: object x-speakeasy-name-override: GrantAccessProfileFilter c1.api.accessreview.v1.GrantsAddedBetween: description: The GrantsAddedBetween message. properties: endDate: format: date-time type: - string - 'null' startDate: format: date-time type: - string - 'null' title: Grants Added Between type: object x-speakeasy-name-override: GrantsAddedBetween c1.api.app.v1.AppEntitlementRef: description: The AppEntitlementRef message. properties: appId: description: The appId field. type: string id: description: The id field. type: string title: App Entitlement Ref type: object x-speakeasy-name-override: AppEntitlementRef c1.api.accessreview.v1.IncludedUserAttributeValues: description: The IncludedUserAttributeValues message. properties: values: description: The values field. items: $ref: >- #/components/schemas/c1.api.accessreview.v1.IncludedUserAttributeValue type: - array - 'null' title: Included User Attribute Values type: object x-speakeasy-name-override: IncludedUserAttributeValues c1.api.accessreview.v1.IncludedUserAttributeValue: description: The IncludedUserAttributeValue message. properties: value: description: The value field. type: string title: Included User Attribute Value type: object x-speakeasy-name-override: IncludedUserAttributeValue securitySchemes: bearerAuth: scheme: bearer type: http oauth: description: >- This API uses OAuth2 with the Client Credential flow. Client Credentials must be sent in the BODY, not the headers. For an example of how to implement this, refer to the [c1TokenSource.Token()](https://github.com/ConductorOne/conductorone-sdk-go/blob/3375fe7c0126d17e7ec4e711693dee7b791023aa/token_source.go#L101-L187) function. flows: clientCredentials: scopes: {} tokenUrl: /auth/v1/token type: oauth2 ````