> ## Documentation Index > Fetch the complete documentation index at: https://www.c1.ai/docs/llms.txt > Use this file to discover all available pages before exploring further. # Search Scope Role Bindings Per Catalog > Search scope-role bindings in a catalog, grouped by (app, scope) (one entry per scope with all role IDs aggregated). When app_id is provided the result is scoped to that app; when omitted the result spans every app in the catalog, ordered by (app_id, scope_id) so a client groupBy(app_id) produces contiguous app sections across page boundaries. ## OpenAPI ````yaml https://spec.speakeasy.com/conductor-one/conductorone/my-source-with-code-samples get /api/v1/catalogs/{catalog_id}/scope_role_bindings openapi: 3.1.0 info: description: The C1 API is a HTTP API for managing C1 resources. title: C1 API version: 0.1.0-alpha servers: - description: The C1 API server for the current tenant. url: https://{tenantDomain}.conductor.one variables: tenantDomain: default: example description: The domain of the tenant to use for this request. security: - bearerAuth: [] oauth: [] paths: /api/v1/catalogs/{catalog_id}/scope_role_bindings: get: tags: - Request Catalog summary: Search Scope Role Bindings Per Catalog description: >- Search scope-role bindings in a catalog, grouped by (app, scope) (one entry per scope with all role IDs aggregated). When app_id is provided the result is scoped to that app; when omitted the result spans every app in the catalog, ordered by (app_id, scope_id) so a client groupBy(app_id) produces contiguous app sections across page boundaries. operationId: >- c1.api.requestcatalog.v1.RequestCatalogManagementService.SearchScopeRoleBindingsPerCatalog parameters: - in: path name: catalog_id required: true schema: description: The unique identifier of the access profile. type: string - in: query name: app_id schema: description: >- Optional: when set, restrict to a single app. When empty, span every app in the catalog. type: string - in: query name: page_size schema: description: The maximum number of results to return per page. format: int32 type: integer - in: query name: page_token schema: description: >- The token from a previous response's next_page_token, used to fetch the next page. type: string - in: query name: query schema: description: >- Optional substring search on the scope's app_resource display name (case-insensitive). type: string - in: query name: resource_type_id schema: description: >- Optional filter on the scope's app resource type (for example, AWS Account). type: string responses: '200': content: application/json: schema: $ref: >- #/components/schemas/c1.api.requestcatalog.v1.RequestCatalogManagementServiceSearchScopeRoleBindingsPerCatalogResponse description: >- The response message containing the scope-role bindings in an access profile, one entry per (app, scope). components: schemas: c1.api.requestcatalog.v1.RequestCatalogManagementServiceSearchScopeRoleBindingsPerCatalogResponse: description: >- The response message containing the scope-role bindings in an access profile, one entry per (app, scope). properties: list: description: >- The list of scopes, each with its bound roles, ordered by app and then scope. items: $ref: '#/components/schemas/c1.api.requestcatalog.v1.ScopeWithRoles' type: - array - 'null' nextPageToken: description: >- The nextPageToken is shown for the next page if the number of results is larger than the max page size. The server returns one page of results and the nextPageToken until all results are retrieved. To retrieve the next page, use the same request and append a pageToken field with the value of nextPageToken shown on the previous page. type: string title: >- Request Catalog Management Service Search Scope Role Bindings Per Catalog Response type: object x-speakeasy-name-override: RequestCatalogManagementServiceSearchScopeRoleBindingsPerCatalogResponse c1.api.requestcatalog.v1.ScopeWithRoles: description: >- ScopeWithRoles represents a single scope resource in an access profile with all of its bound roles. There is one entry per unique (app, scope). When is_app_access is true, roles is empty and the binding grants app access instead of a role. properties: appId: description: The unique identifier of the app that the scope belongs to. type: string catalogId: description: The unique identifier of the access profile. type: string isAppAccess: description: >- True when the binding is an app-access entitlement rather than a role; roles is empty in that case. type: boolean ref: oneOf: - $ref: >- #/components/schemas/c1.api.requestcatalog.v1.ScopeRoleBindingRef - type: 'null' roles: description: The roles bound to this scope in the access profile. items: $ref: '#/components/schemas/c1.api.app.v1.AppResource' type: - array - 'null' scopeAppResource: oneOf: - $ref: '#/components/schemas/c1.api.app.v1.AppResource' - type: 'null' scopeAppResourceType: oneOf: - $ref: '#/components/schemas/c1.api.app.v1.AppResourceType' - type: 'null' title: Scope With Roles type: object x-speakeasy-name-override: ScopeWithRoles c1.api.requestcatalog.v1.ScopeRoleBindingRef: description: >- ScopeRoleBindingRef uniquely identifies a scope's binding state within an access profile and app. properties: appId: description: The unique identifier of the app. type: string catalogId: description: The unique identifier of the access profile. type: string scopeId: description: The unique identifier of the scope app resource. type: string title: Scope Role Binding Ref type: object x-speakeasy-name-override: ScopeRoleBindingRef c1.api.app.v1.AppResource: description: > The app resource message is a single resource that can have entitlements. This message contains a oneof named metadata. Only a single field of the following list may be set at a time: - secretTrait properties: accessConfigId: description: |- The access config ID for this resource. May be empty. Must be one of the builtin access config IDs or empty. type: string agentTrait: oneOf: - $ref: '#/components/schemas/c1.api.app.v1.AgentTrait' - type: 'null' annotations: additionalProperties: type: string description: |- Bounded key/value metadata bag for IaC marking and customer tags. See .rfcs/object-annotations.md §2. Limits: ≤16 entries; keys 1–128 chars matching ^[A-Za-z][A-Za-z0-9._/-]{0,127}$; values 0–256 chars URL-safe ASCII; total serialized ≤ 4096 bytes. Keys matching ^c1/ are reserved. Well-known keys: `managed_by`, `iac_workspace`, `iac_resource_address`, `iac_tool_version`. Most AppResources are connector-synced; user-supplied annotations on a synced resource will be overwritten by the next sync. The annotations bag is most useful on user-created groups (the `conductorone_app_resource` TF resource). type: object x-speakeasy-terraform-plan-modifier: imports: - >- github.com/conductorone/terraform-provider-conductorone/internal/annotations schemaDefinition: annotations.PlanModifier() appId: description: The app that this resource belongs to. type: string appResourceTypeId: description: The resource type that this resource is. type: string createdAt: format: date-time readOnly: true type: - string - 'null' customDescription: description: A custom description that can be set for a resource. type: string deletedAt: format: date-time readOnly: true type: - string - 'null' description: description: The description set for the resource. type: string displayName: description: The display name for this resource. type: string externalId: description: >- The upstream product's native external ID for this resource (e.g. an Okta group ID). Populated from the connector's external ID during sync. readOnly: true type: string grantCount: description: The number of grants to this resource. format: int64 type: string id: description: The id of the resource. type: string isManuallyManaged: description: >- Whether the resource was created manually in ConductorOne rather than synced from a connector. Only manually created resources can be deleted in ConductorOne. readOnly: true type: boolean matchBatonId: description: The matchBatonId field. type: string nhiDetail: description: |- Axis-2 detail refining nhi_type (e.g. "aws.role.lambda"). Read-only; translated from the model. readOnly: true type: string nhiType: description: |- The NHI classification (K3 spine) for this resource. Populated for non-human-identity resources; UNSPECIFIED for everything else. Mirrors agent_trait: read-only and translated from the model enum at the API boundary. enum: - NHI_TYPE_UNSPECIFIED - NHI_TYPE_APP_REGISTRATION - NHI_TYPE_ASSUMABLE_ROLE - NHI_TYPE_MANAGED_IDENTITY readOnly: true type: string x-speakeasy-unknown-values: allow parentAppResourceId: description: >- The parent resource id, if this resource is a child of another resource. type: string parentAppResourceTypeId: description: >- The parent resource type id, if this resource is a child of another resource. type: string profile: additionalProperties: true readOnly: true type: - object - 'null' secretTrait: oneOf: - $ref: '#/components/schemas/c1.api.app.v1.SecretTrait' - type: 'null' updatedAt: format: date-time readOnly: true type: - string - 'null' title: App Resource type: object x-speakeasy-entity: App Resource x-speakeasy-name-override: AppResource c1.api.app.v1.AppResourceType: description: >- The AppResourceType is referenced by an app entitlement defining its resource types. Commonly things like Group or Role. properties: appId: description: The ID of the app that is associated with the app resource type readOnly: true type: string createdAt: format: date-time readOnly: true type: - string - 'null' deletedAt: format: date-time readOnly: true type: - string - 'null' displayName: description: The display name of the app resource type. type: string id: description: The unique ID for the app resource type. readOnly: true type: string traitIds: description: Associated trait ids items: type: string type: - array - 'null' updatedAt: format: date-time readOnly: true type: - string - 'null' title: App Resource Type type: object x-speakeasy-entity: App Resource Type x-speakeasy-name-override: AppResourceType c1.api.app.v1.AgentTrait: description: >- AgentTrait carries metadata for AI-agent resources surfaced in the Inventory. properties: identityAppUserId: description: >- The C1 app user ID of the service-account identity this agent authenticates as. Empty if the backing identity has not yet been resolved. type: string status: description: The agent's lifecycle status (READY, DISABLED, DELETED). enum: - AGENT_STATUS_UNSPECIFIED - AGENT_STATUS_READY - AGENT_STATUS_DISABLED - AGENT_STATUS_DELETED type: string x-speakeasy-unknown-values: allow title: Agent Trait type: object x-speakeasy-name-override: AgentTrait c1.api.app.v1.SecretTrait: description: The SecretTrait message. properties: createdByAppUserId: description: >- The AppUser id that created this credential. Read-only; resolved from the model during uplift. Distinct from identity_app_user_id (the holder) and from the resource's Owner (a separate assignment, not part of this message). type: string credentialDetail: description: >- Platform-specific credential subtype detail, finer than credential_type (e.g. "GCP service-account key"). Read-only; translated from the model. type: string identityAppUserId: description: The identityAppUserId field. type: string lastUsedAt: format: date-time type: - string - 'null' secretCreatedAt: format: date-time type: - string - 'null' secretExpiresAt: format: date-time type: - string - 'null' title: Secret Trait type: object x-speakeasy-name-override: SecretTrait securitySchemes: bearerAuth: scheme: bearer type: http oauth: description: >- This API uses OAuth2 with the Client Credential flow. Client Credentials must be sent in the BODY, not the headers. For an example of how to implement this, refer to the [c1TokenSource.Token()](https://github.com/ConductorOne/conductorone-sdk-go/blob/3375fe7c0126d17e7ec4e711693dee7b791023aa/token_source.go#L101-L187) function. flows: clientCredentials: scopes: {} tokenUrl: /auth/v1/token type: oauth2 ````