> ## Documentation Index > Fetch the complete documentation index at: https://conductorone-eu-instance.mintlify.site/llms.txt > Use this file to discover all available pages before exploring further. # List History > List the change history for one of the caller's own per-app limits, newest first. Removing the last control deletes the row, so this is where a subject reads back the pause they lifted and when they lifted it. VIEWER, not the OWNER the two admin-plane history RPCs use. This service carries no user id in any request, so it can only ever return the caller's own rows: gating it at OWNER would put an owner role in front of the caller's own data and still return nothing but that. An admin auditing another subject's app limits needs an admin-plane read, which this service is not and deliberately does not become. ## OpenAPI ````yaml https://spec.speakeasy.com/conductor-one/conductorone/my-source-with-code-samples get /api/v1/funds/my/app-limits/{app_id}/history openapi: 3.1.0 info: description: The C1 API is a HTTP API for managing C1 resources. title: C1 API version: 0.1.0-alpha servers: - description: The C1 API server for the current tenant. url: https://{tenantDomain}.conductor.one variables: tenantDomain: default: example description: The domain of the tenant to use for this request. security: - bearerAuth: [] oauth: [] paths: /api/v1/funds/my/app-limits/{app_id}/history: get: tags: - My Fund Limits summary: List History description: >- List the change history for one of the caller's own per-app limits, newest first. Removing the last control deletes the row, so this is where a subject reads back the pause they lifted and when they lifted it. VIEWER, not the OWNER the two admin-plane history RPCs use. This service carries no user id in any request, so it can only ever return the caller's own rows: gating it at OWNER would put an owner role in front of the caller's own data and still return nothing but that. An admin auditing another subject's app limits needs an admin-plane read, which this service is not and deliberately does not become. operationId: c1.api.funds.v1.MyFundLimitsService.ListHistory parameters: - in: path name: app_id required: true schema: description: The appId field. type: string - in: query name: page_size schema: description: The pageSize field. format: int32 type: integer - in: query name: page_token schema: description: The pageToken field. type: string responses: '200': content: application/json: schema: $ref: >- #/components/schemas/c1.api.funds.v1.MyFundLimitsServiceListHistoryResponse description: Successful response components: schemas: c1.api.funds.v1.MyFundLimitsServiceListHistoryResponse: description: The MyFundLimitsServiceListHistoryResponse message. properties: list: description: The list field. items: $ref: '#/components/schemas/c1.api.funds.v1.MyFundLimitHistoryEntry' type: - array - 'null' nextPageToken: description: The nextPageToken field. type: string title: My Fund Limits Service List History Response type: object x-speakeasy-name-override: MyFundLimitsServiceListHistoryResponse c1.api.funds.v1.MyFundLimitHistoryEntry: description: The MyFundLimitHistoryEntry message. properties: metadata: oneOf: - $ref: '#/components/schemas/c1.api.history.v1.HistoryEntryMetadata' - type: 'null' snapshot: oneOf: - $ref: '#/components/schemas/c1.api.funds.v1.MyFundLimit' - type: 'null' title: My Fund Limit History Entry type: object x-speakeasy-name-override: MyFundLimitHistoryEntry c1.api.history.v1.HistoryEntryMetadata: description: |- HistoryEntryMetadata is the shared metadata envelope embedded on every per-service HistoryEntry. The strongly-typed snapshot lives on the per-service entry message alongside this envelope. properties: actor: oneOf: - $ref: '#/components/schemas/c1.api.history.v1.HistoryActor' - type: 'null' annotations: description: |- Server-rendered annotations: known keys carry display_label and (for ticket_id, etc.) display_url resolved from tenant config. Cap mirrors the per-object annotation ceiling (16). items: $ref: '#/components/schemas/c1.api.history.v1.HistoryAnnotation' type: - array - 'null' changeKind: description: |- Storage-model enum re-exported here for wire compatibility with the storage row. UNSPECIFIED should never appear on the wire. enum: - CHANGE_KIND_UNSPECIFIED - CHANGE_KIND_CREATE - CHANGE_KIND_PUT - CHANGE_KIND_HARD_DELETE type: string x-speakeasy-unknown-values: allow createdAt: format: date-time type: - string - 'null' id: description: KSUID. Same value as c1.models.history.v1.ObjectHistory.id. type: string syslogEventId: description: |- System Log event id — KSUID of the OCSF event recorded for this write. Empty for non-RPC writes (workflows, cron). Customer-facing copy says "System Log event"; the underlying format is OCSF. type: string traceId: description: |- OTel trace correlation. Empty when no valid span at write time. 32-hex-char otel trace id or empty. type: string title: History Entry Metadata type: object x-speakeasy-name-override: HistoryEntryMetadata c1.api.funds.v1.MyFundLimit: description: >- MyFundLimit is one of the caller's own per-app limits. It carries no user id: it is always the caller's. properties: appId: description: The C1 App this limit applies to. type: string controls: oneOf: - $ref: '#/components/schemas/c1.models.funds.v1.SpendControls' - type: 'null' createdAt: format: date-time type: - string - 'null' updatedAt: format: date-time type: - string - 'null' title: My Fund Limit type: object x-speakeasy-name-override: MyFundLimit c1.api.history.v1.HistoryActor: description: |- HistoryActor is a typed reference to whoever performed the change. kind mirrors the storage-model ActorKind enum; user_id is set when kind corresponds to a user principal (API / SUPPORT) so the frontend can resolve the user via its own avatar / lookup hooks. Protos reference objects by id; the frontend renders / caches itself. The raw passport fields (token_id / principal_id) intentionally do not leave the server. Non-user actors (workflow, connector, internal) are identified by `kind` alone; correlating IDs (workflow_run_id, etc.) flow through `HistoryAnnotation` instead of being plucked into the actor message. properties: kind: description: The kind field. enum: - ACTOR_KIND_UNSPECIFIED - ACTOR_KIND_API - ACTOR_KIND_SLACK - ACTOR_KIND_MSTEAMS - ACTOR_KIND_JIRA_CLOUD - ACTOR_KIND_INTERNAL - ACTOR_KIND_SUPPORT - ACTOR_KIND_WORKFLOW type: string x-speakeasy-unknown-values: allow userId: description: |- Bare KSUID. Set when kind = ACTOR_KIND_API or ACTOR_KIND_SUPPORT. Empty otherwise. The frontend resolves user_id → display name via the same lookup paths it uses elsewhere (avatars, mentions, ...). type: string title: History Actor type: object x-speakeasy-name-override: HistoryActor c1.api.history.v1.HistoryAnnotation: description: |- HistoryAnnotation is a single operator-provided key/value rendered with per-key display metadata. Annotations are minted from the Tx.*WithHistoryAnnotations / db.WithHistoryAnnotations call options. properties: displayLabel: description: Server-rendered label, e.g. "Ticket". type: string displayUrl: description: |- Resolved from tenant config; "" if none. Frontend applies its own scheme allowlist. type: string displayValue: description: UI-friendly rendering (truncated / reshaped from raw_value). type: string key: description: 'Storage-side key. Bounds: ^[a-z][a-z0-9_.-]{0,63}$.' type: string kind: description: The kind field. enum: - ANNOTATION_KIND_UNSPECIFIED - ANNOTATION_KIND_GENERIC - ANNOTATION_KIND_TICKET - ANNOTATION_KIND_REASON - ANNOTATION_KIND_WORKFLOW - ANNOTATION_KIND_BATCH - ANNOTATION_KIND_CORRELATION - ANNOTATION_KIND_AUTOMATION type: string x-speakeasy-unknown-values: allow rawValue: description: >- Raw value as stored in ObjectHistory.annotations; storage-side values are capped at 512 bytes. type: string title: History Annotation type: object x-speakeasy-name-override: HistoryAnnotation c1.models.funds.v1.SpendControls: description: |- SpendControls is the one control shape carried by every authority scope. Per-row resolution, identical everywhere: suspension present -> deny; unexpired extension -> extension.limit; limit present -> limit; otherwise this row states no opinion and resolution falls through. Not a oneof: two transitions need the losing field to survive. Unsuspending restores the limit it froze, and a lapsed extension falls back to its base rather than to the next layer. Pinned by TestControlsCoPresenceSurvivesEveryTransition in pkg/funds. properties: extension: oneOf: - $ref: '#/components/schemas/c1.models.funds.v1.SpendExtension' - type: 'null' limit: oneOf: - $ref: '#/components/schemas/c1.models.funds.v1.SpendLimit' - type: 'null' period: description: |- Only valid together with limit: a period without its amount would reinterpret some other layer's number in a cadence that layer never agreed to. enum: - PERIOD_KIND_UNSPECIFIED - PERIOD_KIND_DAILY - PERIOD_KIND_WEEKLY - PERIOD_KIND_MONTHLY - PERIOD_KIND_QUARTERLY - PERIOD_KIND_YEARLY type: string x-speakeasy-unknown-values: allow suspension: oneOf: - $ref: '#/components/schemas/c1.models.funds.v1.SpendSuspension' - type: 'null' title: Spend Controls type: object x-speakeasy-name-override: SpendControls c1.models.funds.v1.SpendExtension: description: |- SpendExtension replaces the row's total with a temporary one until expires_at. It never changes the period, and it never expresses a refusal — a temporary refusal is a SpendSuspension. properties: expiresAt: format: date-time type: - string - 'null' limit: oneOf: - $ref: '#/components/schemas/c1.models.funds.v1.SpendLimit' - type: 'null' reason: description: >- Subject-visible: "why do I have this bump". Mutation rationale rides the history change_reason annotation instead. type: string title: Spend Extension type: object x-speakeasy-name-override: SpendExtension c1.models.funds.v1.SpendLimit: description: > SpendLimit is the three-way behavior fork. Which arms are legal depends on the scope carrying it; pkg/funds enforces that matrix, not the schema, because one SpendControls shape is shared by every scope. This message contains a oneof named kind. Only a single field of the following list may be set at a time: - unlimited - amount - blocked properties: amount: oneOf: - $ref: '#/components/schemas/c1.models.funds.v1.SpendLimitAmount' - type: 'null' blocked: oneOf: - $ref: '#/components/schemas/c1.models.funds.v1.SpendLimitBlocked' - type: 'null' unlimited: oneOf: - $ref: '#/components/schemas/c1.models.funds.v1.SpendLimitUnlimited' - type: 'null' title: Spend Limit type: object x-speakeasy-name-override: SpendLimit c1.models.funds.v1.SpendSuspension: description: >- SpendSuspension freezes a scope without erasing the limit it must restore on unsuspend, which is why it lives beside the SpendLimit oneof rather than inside it. properties: reason: description: The reason field. type: string suspendedAt: format: date-time type: - string - 'null' title: Spend Suspension type: object x-speakeasy-name-override: SpendSuspension c1.models.funds.v1.SpendLimitAmount: description: SpendLimitAmount caps spend at money per resolved period. properties: money: oneOf: - $ref: '#/components/schemas/c1.models.funds.v1.Money' - type: 'null' title: Spend Limit Amount type: object x-speakeasy-name-override: SpendLimitAmount c1.models.funds.v1.SpendLimitBlocked: description: >- SpendLimitBlocked refuses supply at this scope. Distinct from suspension: blocked is a stated policy posture, suspension is a reversible freeze that preserves the numbers underneath it. title: Spend Limit Blocked type: object x-speakeasy-name-override: SpendLimitBlocked c1.models.funds.v1.SpendLimitUnlimited: description: |- SpendLimitUnlimited is a tracking limit: full accounting, no admission condition. The maximum element, so an unlimited default makes grant rules no-ops. title: Spend Limit Unlimited type: object x-speakeasy-name-override: SpendLimitUnlimited c1.models.funds.v1.Money: description: >- Money is wire-compatible with google.type.Money field-for-field, so the public API converts with a field copy. Declared here rather than imported because protoc-gen-pgdb mirrors a nested message by calling its generated DBReflect, which only exists for messages this repo generates. properties: currencyCode: description: >- ISO 4217 currency code. Must equal the tenant's FundPolicy.currency_code. type: string nanos: description: >- Nano-unit remainder, 0 <= nanos < 10^9. Non-negative for the same reason as units, which also keeps the (units, nanos) pair unambiguous. format: int32 type: integer units: description: >- Non-negative — grants, never debts — and bounded so units * 10^9 + nanos always fits int64. Without the ceiling a large value wraps positive and installs a limit nobody granted. The pair check spans two fields, so pkg/funds re-checks it on every conversion. format: int64 type: string title: Money type: object x-speakeasy-name-override: Money securitySchemes: bearerAuth: scheme: bearer type: http oauth: description: >- This API uses OAuth2 with the Client Credential flow. Client Credentials must be sent in the BODY, not the headers. For an example of how to implement this, refer to the [c1TokenSource.Token()](https://github.com/ConductorOne/conductorone-sdk-go/blob/3375fe7c0126d17e7ec4e711693dee7b791023aa/token_source.go#L101-L187) function. flows: clientCredentials: scopes: {} tokenUrl: /auth/v1/token type: oauth2 ````