> ## Documentation Index > Fetch the complete documentation index at: https://conductorone-docs-google-workspace-action-examples.mintlify.site/llms.txt > Use this file to discover all available pages before exploring further. # Search > Search the tenant's subject-app limit rows. Reads the Postgres mirror: the runtime row is keyed on (tenant, subject), so a tenant-wide listing has no runtime query at all. Filters narrow by subject, by app, and by state; empty filters return every live row in the tenant. POST rather than GET: the filters are repeated fields, which the gateway cannot carry as query parameters. Pagination is keyset-based over (pksk), the storage primary key, so a concurrent write to a filtered field cannot duplicate or omit a row across pages the way an offset page can. ## OpenAPI ````yaml https://spec.speakeasy.com/conductor-one/conductorone/my-source-with-code-samples post /api/v1/funds/subject-app-limits/search openapi: 3.1.0 info: description: The C1 API is a HTTP API for managing C1 resources. title: C1 API version: 0.1.0-alpha servers: - description: The C1 API server for the current tenant. url: https://{tenantDomain}.conductor.one variables: tenantDomain: default: example description: The domain of the tenant to use for this request. security: - bearerAuth: [] oauth: [] paths: /api/v1/funds/subject-app-limits/search: post: tags: - Subject App Limits summary: Search description: |- Search the tenant's subject-app limit rows. Reads the Postgres mirror: the runtime row is keyed on (tenant, subject), so a tenant-wide listing has no runtime query at all. Filters narrow by subject, by app, and by state; empty filters return every live row in the tenant. POST rather than GET: the filters are repeated fields, which the gateway cannot carry as query parameters. Pagination is keyset-based over (pksk), the storage primary key, so a concurrent write to a filtered field cannot duplicate or omit a row across pages the way an offset page can. operationId: c1.api.funds.v1.SubjectAppLimitService.Search requestBody: content: application/json: schema: $ref: >- #/components/schemas/c1.api.funds.v1.SubjectAppLimitServiceSearchRequest responses: '200': content: application/json: schema: $ref: >- #/components/schemas/c1.api.funds.v1.SubjectAppLimitServiceSearchResponse description: Successful response components: schemas: c1.api.funds.v1.SubjectAppLimitServiceSearchRequest: description: The SubjectAppLimitServiceSearchRequest message. properties: appIds: description: Restrict to these apps; empty returns every app. items: type: string type: - array - 'null' pageSize: description: The pageSize field. format: int32 type: integer pageToken: description: The pageToken field. type: string states: oneOf: - $ref: '#/components/schemas/c1.api.funds.v1.SubjectAppLimitStateFilter' - type: 'null' userIds: description: Restrict to these subjects; empty returns every row in the tenant. items: type: string type: - array - 'null' title: Subject App Limit Service Search Request type: object x-speakeasy-name-override: SubjectAppLimitServiceSearchRequest c1.api.funds.v1.SubjectAppLimitServiceSearchResponse: description: The SubjectAppLimitServiceSearchResponse message. properties: list: description: The list field. items: $ref: '#/components/schemas/c1.api.funds.v1.SubjectAppLimit' type: - array - 'null' nextPageToken: description: The nextPageToken field. type: string title: Subject App Limit Service Search Response type: object x-speakeasy-name-override: SubjectAppLimitServiceSearchResponse c1.api.funds.v1.SubjectAppLimitStateFilter: description: >- SubjectAppLimitStateFilter is the structured state filter. The three states are mutually exclusive by construction: suspended is suspension present; explicit-limit is suspension absent AND limit present; inheriting is neither. Combining them is a union. Unset (all false) does not filter by state at all. properties: explicitLimit: description: >- No suspension and a limit arm is present, whatever it states. True for the seeded support case: "show me everyone with an explicit per-app number". type: boolean inheriting: description: |- No suspension and no limit: the row exists but states no opinion, so resolution falls through it. No compliant write persists such a row — the clearing verbs delete it — so a match is a legacy or corrupt row, which is exactly what an admin auditing "which rows are doing nothing" needs the filter to surface. type: boolean suspended: description: >- A suspension is present: the app is paused for this subject. A row that also carries a limit is still suspended — the suspension is what its subject experiences. type: boolean title: Subject App Limit State Filter type: object x-speakeasy-name-override: SubjectAppLimitStateFilter c1.api.funds.v1.SubjectAppLimit: description: |- SubjectAppLimit is one subject's per-app limit row as the admin plane renders it. The subject is named explicitly, unlike MyFundLimit, which is always the caller's. properties: appId: description: The C1 App this limit applies to. type: string controls: oneOf: - $ref: '#/components/schemas/c1.models.funds.v1.SpendControls' - type: 'null' createdAt: format: date-time type: - string - 'null' deletedAt: format: date-time type: - string - 'null' tenantId: description: The tenantId field. type: string updatedAt: format: date-time type: - string - 'null' userId: description: Canonical c1.models.user.v2.User id. type: string title: Subject App Limit type: object x-speakeasy-name-override: SubjectAppLimit c1.models.funds.v1.SpendControls: description: |- SpendControls is the one control shape carried by every authority scope. Per-row resolution, identical everywhere: suspension present -> deny; unexpired extension -> extension.limit; limit present -> limit; otherwise this row states no opinion and resolution falls through. Not a oneof: two transitions need the losing field to survive. Unsuspending restores the limit it froze, and a lapsed extension falls back to its base rather than to the next layer. Pinned by TestControlsCoPresenceSurvivesEveryTransition in pkg/funds. properties: extension: oneOf: - $ref: '#/components/schemas/c1.models.funds.v1.SpendExtension' - type: 'null' limit: oneOf: - $ref: '#/components/schemas/c1.models.funds.v1.SpendLimit' - type: 'null' period: description: |- Only valid together with limit: a period without its amount would reinterpret some other layer's number in a cadence that layer never agreed to. enum: - PERIOD_KIND_UNSPECIFIED - PERIOD_KIND_DAILY - PERIOD_KIND_WEEKLY - PERIOD_KIND_MONTHLY - PERIOD_KIND_QUARTERLY - PERIOD_KIND_YEARLY type: string x-speakeasy-unknown-values: allow suspension: oneOf: - $ref: '#/components/schemas/c1.models.funds.v1.SpendSuspension' - type: 'null' title: Spend Controls type: object x-speakeasy-name-override: SpendControls c1.models.funds.v1.SpendExtension: description: |- SpendExtension replaces the row's total with a temporary one until expires_at. It never changes the period, and it never expresses a refusal — a temporary refusal is a SpendSuspension. properties: expiresAt: format: date-time type: - string - 'null' limit: oneOf: - $ref: '#/components/schemas/c1.models.funds.v1.SpendLimit' - type: 'null' reason: description: >- Subject-visible: "why do I have this bump". Mutation rationale rides the history change_reason annotation instead. type: string title: Spend Extension type: object x-speakeasy-name-override: SpendExtension c1.models.funds.v1.SpendLimit: description: > SpendLimit is the three-way behavior fork. Which arms are legal depends on the scope carrying it; pkg/funds enforces that matrix, not the schema, because one SpendControls shape is shared by every scope. This message contains a oneof named kind. Only a single field of the following list may be set at a time: - unlimited - amount - blocked properties: amount: oneOf: - $ref: '#/components/schemas/c1.models.funds.v1.SpendLimitAmount' - type: 'null' blocked: oneOf: - $ref: '#/components/schemas/c1.models.funds.v1.SpendLimitBlocked' - type: 'null' unlimited: oneOf: - $ref: '#/components/schemas/c1.models.funds.v1.SpendLimitUnlimited' - type: 'null' title: Spend Limit type: object x-speakeasy-name-override: SpendLimit c1.models.funds.v1.SpendSuspension: description: >- SpendSuspension freezes a scope without erasing the limit it must restore on unsuspend, which is why it lives beside the SpendLimit oneof rather than inside it. properties: reason: description: The reason field. type: string suspendedAt: format: date-time type: - string - 'null' title: Spend Suspension type: object x-speakeasy-name-override: SpendSuspension c1.models.funds.v1.SpendLimitAmount: description: SpendLimitAmount caps spend at money per resolved period. properties: money: oneOf: - $ref: '#/components/schemas/c1.models.funds.v1.Money' - type: 'null' title: Spend Limit Amount type: object x-speakeasy-name-override: SpendLimitAmount c1.models.funds.v1.SpendLimitBlocked: description: >- SpendLimitBlocked refuses supply at this scope. Distinct from suspension: blocked is a stated policy posture, suspension is a reversible freeze that preserves the numbers underneath it. title: Spend Limit Blocked type: object x-speakeasy-name-override: SpendLimitBlocked c1.models.funds.v1.SpendLimitUnlimited: description: |- SpendLimitUnlimited is a tracking limit: full accounting, no admission condition. The maximum element, so an unlimited default makes grant rules no-ops. title: Spend Limit Unlimited type: object x-speakeasy-name-override: SpendLimitUnlimited c1.models.funds.v1.Money: description: >- Money is wire-compatible with google.type.Money field-for-field, so the public API converts with a field copy. Declared here rather than imported because protoc-gen-pgdb mirrors a nested message by calling its generated DBReflect, which only exists for messages this repo generates. properties: currencyCode: description: >- ISO 4217 currency code. Must equal the tenant's FundPolicy.currency_code. type: string nanos: description: >- Nano-unit remainder, 0 <= nanos < 10^9. Non-negative for the same reason as units, which also keeps the (units, nanos) pair unambiguous. format: int32 type: integer units: description: >- Non-negative — grants, never debts — and bounded so units * 10^9 + nanos always fits int64. Without the ceiling a large value wraps positive and installs a limit nobody granted. The pair check spans two fields, so pkg/funds re-checks it on every conversion. format: int64 type: string title: Money type: object x-speakeasy-name-override: Money securitySchemes: bearerAuth: scheme: bearer type: http oauth: description: >- This API uses OAuth2 with the Client Credential flow. Client Credentials must be sent in the BODY, not the headers. For an example of how to implement this, refer to the [c1TokenSource.Token()](https://github.com/ConductorOne/conductorone-sdk-go/blob/3375fe7c0126d17e7ec4e711693dee7b791023aa/token_source.go#L101-L187) function. flows: clientCredentials: scopes: {} tokenUrl: /auth/v1/token type: oauth2 ````