> ## Documentation Index
> Fetch the complete documentation index at: https://conductorone-docs-google-workspace-action-examples.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Search

> Search returns the ungoverned, enabled observation rows behind one
 shadow-mcp finding -- the same present-set that produced its evidence
 counts. Authorized as VIEWER -- the same role required to read the
 finding itself.



## OpenAPI

````yaml https://spec.speakeasy.com/conductor-one/conductorone/my-source-with-code-samples post /api/v1/search/shadow_mcp_occurrences
openapi: 3.1.0
info:
  description: The C1 API is a HTTP API for managing C1 resources.
  title: C1 API
  version: 0.1.0-alpha
servers:
  - description: The C1 API server for the current tenant.
    url: https://{tenantDomain}.conductor.one
    variables:
      tenantDomain:
        default: example
        description: The domain of the tenant to use for this request.
security:
  - bearerAuth: []
    oauth: []
paths:
  /api/v1/search/shadow_mcp_occurrences:
    post:
      tags:
        - Findings
      summary: Search
      description: |-
        Search returns the ungoverned, enabled observation rows behind one
         shadow-mcp finding -- the same present-set that produced its evidence
         counts. Authorized as VIEWER -- the same role required to read the
         finding itself.
      operationId: c1.api.finding.v1.ShadowMcpOccurrenceService.Search
      requestBody:
        content:
          application/json:
            schema:
              $ref: >-
                #/components/schemas/c1.api.finding.v1.ShadowMcpOccurrenceServiceSearchRequest
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: >-
                  #/components/schemas/c1.api.finding.v1.ShadowMcpOccurrenceServiceSearchResponse
          description: Successful response
components:
  schemas:
    c1.api.finding.v1.ShadowMcpOccurrenceServiceSearchRequest:
      description: The ShadowMcpOccurrenceServiceSearchRequest message.
      properties:
        findingId:
          description: The shadow-mcp finding to resolve occurrences for.
          type: string
        pageSize:
          description: The pageSize field.
          format: int32
          type: integer
        pageToken:
          description: The pageToken field.
          type: string
      title: Shadow Mcp Occurrence Service Search Request
      type: object
      x-speakeasy-name-override: ShadowMcpOccurrenceServiceSearchRequest
    c1.api.finding.v1.ShadowMcpOccurrenceServiceSearchResponse:
      description: The ShadowMcpOccurrenceServiceSearchResponse message.
      properties:
        list:
          description: The list field.
          items:
            $ref: '#/components/schemas/c1.api.finding.v1.ShadowMcpOccurrence'
          type:
            - array
            - 'null'
        nextPageToken:
          description: The nextPageToken field.
          type: string
      title: Shadow Mcp Occurrence Service Search Response
      type: object
      x-speakeasy-name-override: ShadowMcpOccurrenceServiceSearchResponse
    c1.api.finding.v1.ShadowMcpOccurrence:
      description: |-
        ShadowMcpOccurrence is one device running a shadow-mcp finding's MCP
         product, resolved live from DeviceInventoryMcpObservation rather than
         stored on the Finding -- see ShadowMcpEvidence's own doc for why occurrence
         detail isn't persisted there.
      properties:
        deviceId:
          description: The deviceId field.
          type: string
        firstSeenAt:
          format: date-time
          type:
            - string
            - 'null'
        harnessKind:
          description: The harnessKind field.
          type: string
        lastSeenAt:
          format: date-time
          type:
            - string
            - 'null'
        userId:
          description: >-
            Resolved owner of the device (device_registration's
            user_principal_id).
             Empty when the device has no resolved owner.
          type: string
      title: Shadow Mcp Occurrence
      type: object
      x-speakeasy-name-override: ShadowMcpOccurrence
  securitySchemes:
    bearerAuth:
      scheme: bearer
      type: http
    oauth:
      description: >-
        This API uses OAuth2 with the Client Credential flow.

        Client Credentials must be sent in the BODY, not the headers.

        For an example of how to implement this, refer to the
        [c1TokenSource.Token()](https://github.com/ConductorOne/conductorone-sdk-go/blob/3375fe7c0126d17e7ec4e711693dee7b791023aa/token_source.go#L101-L187)
        function.
      flows:
        clientCredentials:
          scopes: {}
          tokenUrl: /auth/v1/token
      type: oauth2

````