Search App User Session Policies

Search the effective session policies for users holding this application’s SSO sign-in entitlement. Policies are selected per user, not attached to the application; actual sign-in decisions are recorded in the system log.

POST /api/v1/apps/{app_id}/entitlements/{app_entitlement_id}/session-policies/search

SearchAppUserSessionPolicies

Go

package main

import(
	"context"
	"github.com/conductorone/conductorone-sdk-go/pkg/models/shared"
	conductoronesdkgo "github.com/conductorone/conductorone-sdk-go"
	"github.com/conductorone/conductorone-sdk-go/pkg/models/operations"
	"log"
)

func main() {
    ctx := context.Background()

    s := conductoronesdkgo.New(
        conductoronesdkgo.WithSecurity(shared.Security{
            BearerAuth: "<YOUR_BEARER_TOKEN_HERE>",
            Oauth: "<YOUR_OAUTH_HERE>",
        }),
    )

    res, err := s.SessionPolicy.SearchAppUserSessionPolicies(ctx, operations.C1APISessionPolicyV1SessionPolicyServiceSearchAppUserSessionPoliciesRequest{
        AppEntitlementID: "<id>",
        AppID: "<id>",
    })
    if err != nil {
        log.Fatal(err)
    }
    if res.SessionPolicyServiceSearchAppUserSessionPoliciesResponse != nil {
        // handle response
    }
}

200

{
  "list": [
    {
      "accessTokenTtlSeconds": 123,
      "continuousDefaultOutcome": {
        "allow": {
          "floorLevel": "AUTH_LEVEL_UNSPECIFIED"
        },
        "challengeRequired": {
          "types": [
            "CREDENTIAL_TYPE_UNSPECIFIED"
          ]
        },
        "deny": {
          "reasonAdmin": "<string>",
          "reasonUser": "<string>"
        },
        "enrollmentRequired": {
          "credentialTypes": [
            "CREDENTIAL_TYPE_UNSPECIFIED"
          ]
        },
        "stepUpRequired": {
          "level": "AUTH_LEVEL_UNSPECIFIED",
          "maxAgeSeconds": 123,
          "types": [
            "CREDENTIAL_TYPE_UNSPECIFIED"
          ]
        }
      },
      "continuousRules": [
        {
          "description": "<string>",
          "id": "<string>",
          "matchCel": "<string>",
          "mode": "POLICY_RULE_MODE_UNSPECIFIED",
          "outcome": {
            "allow": {
              "floorLevel": "AUTH_LEVEL_UNSPECIFIED"
            },
            "challengeRequired": {
              "types": [
                "CREDENTIAL_TYPE_UNSPECIFIED"
              ]
            },
            "deny": {
              "reasonAdmin": "<string>",
              "reasonUser": "<string>"
            },
            "enrollmentRequired": {
              "credentialTypes": [
                "CREDENTIAL_TYPE_UNSPECIFIED"
              ]
            },
            "stepUpRequired": {
              "level": "AUTH_LEVEL_UNSPECIFIED",
              "maxAgeSeconds": 123,
              "types": [
                "CREDENTIAL_TYPE_UNSPECIFIED"
              ]
            }
          }
        }
      ],
      "createdAt": "2023-11-07T05:31:56Z",
      "credentialDurations": [
        {
          "accessTokenTtlSeconds": 123,
          "credentialType": "CREDENTIAL_TYPE_UNSPECIFIED",
          "maxSessionDurationSeconds": 123
        }
      ],
      "deletedAt": "2023-11-07T05:31:56Z",
      "displayName": "<string>",
      "id": "<string>",
      "idleTimeoutSeconds": 123,
      "isBuiltin": true,
      "maxSessionDurationSeconds": 123,
      "persistence": "PERSISTENCE_MODE_UNSPECIFIED",
      "priority": 123,
      "refreshRotationWindowSeconds": 123,
      "refreshTokenTtlSeconds": 123,
      "rotateRefreshOnUse": true,
      "ssfReceive": {
        "enabled": true,
        "ssfReceiverStreamIds": [
          "<string>"
        ]
      },
      "ssfTransmit": {
        "enabled": true,
        "eventTypes": [
          "<string>"
        ],
        "ssfTransmitterStreamIds": [
          "<string>"
        ]
      },
      "updatedAt": "2023-11-07T05:31:56Z"
    }
  ],
  "nextPageToken": "<string>"
}

Authorizations

Authorization · string · header · required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Authorization · string · header · required

This API uses OAuth2 with the Client Credential flow. Client Credentials must be sent in the BODY, not the headers. For an example of how to implement this, refer to the c1TokenSource.Token() function.

Path Parameters

app_id · string · required

The SSO application's catalog app.

app_entitlement_id · string · required

The sign-in entitlement on the app. Must be the entitlement named by the app's SSO application; any other entitlement is rejected.

Body

application/json

Search the policies selected for users with accounts holding the application's SSO sign-in entitlement. Accounts not linked to a current user are excluded.

pageSize · integer<int32>

Maximum number of policies per page. Follow next_page_token to complete the search.

pageToken · string

The page token from the previous response.

Response

200 - application/json

Distinct effective policies, ordered by display name and policy ID. A tenant default appears only if it is selected for at least one user. An empty list means no effective policies were found, including when no current users have accounts holding the sign-in entitlement.

Distinct effective policies, ordered by display name and policy ID. A tenant default appears only if it is selected for at least one user. An empty list means no effective policies were found, including when no current users have accounts holding the sign-in entitlement.

list · Session Policy · object[] | null

The list field.

Show child attributes

nextPageToken · string

The token for the next page. Empty on the last page.