> ## Documentation Index
> Fetch the complete documentation index at: https://conductorone-leet-slack-mcp-docs.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# List

> List the scopes defined for an application, one page at a time. To filter
 by resource server, state, or classification, use Search.



## OpenAPI

````yaml https://spec.speakeasy.com/conductor-one/conductorone/my-source-with-code-samples get /api/v1/apps/{app_id}/xaa/scopes
openapi: 3.1.0
info:
  description: The C1 API is a HTTP API for managing C1 resources.
  title: C1 API
  version: 0.1.0-alpha
servers:
  - description: The C1 API server for the current tenant.
    url: https://{tenantDomain}.conductor.one
    variables:
      tenantDomain:
        default: example
        description: The domain of the tenant to use for this request.
security:
  - bearerAuth: []
    oauth: []
paths:
  /api/v1/apps/{app_id}/xaa/scopes:
    get:
      tags:
        - Cross-App Access
      summary: List
      description: >-
        List the scopes defined for an application, one page at a time. To
        filter
         by resource server, state, or classification, use Search.
      operationId: c1.api.cross_app_access.v1.XAAScopeService.List
      parameters:
        - in: path
          name: app_id
          required: true
          schema:
            description: The application to list scopes for.
            type: string
        - in: query
          name: page_size
          schema:
            description: Page size (max 100).
            format: int32
            type: integer
        - in: query
          name: page_token
          schema:
            description: Page token for pagination.
            type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: >-
                  #/components/schemas/c1.api.cross_app_access.v1.XAAScopeServiceListResponse
          description: XAAScopeServiceListResponse returns a page of scopes.
      x-codeSamples:
        - lang: go
          label: List
          source: "package main\n\nimport(\n\t\"context\"\n\t\"github.com/conductorone/conductorone-sdk-go/pkg/models/shared\"\n\tconductoronesdkgo \"github.com/conductorone/conductorone-sdk-go\"\n\t\"github.com/conductorone/conductorone-sdk-go/pkg/models/operations\"\n\t\"log\"\n)\n\nfunc main() {\n    ctx := context.Background()\n\n    s := conductoronesdkgo.New(\n        conductoronesdkgo.WithSecurity(shared.Security{\n            BearerAuth: \"<YOUR_BEARER_TOKEN_HERE>\",\n            Oauth: \"<YOUR_OAUTH_HERE>\",\n        }),\n    )\n\n    res, err := s.XAAScope.List(ctx, operations.C1APICrossAppAccessV1XAAScopeServiceListRequest{\n        AppID: \"<id>\",\n    })\n    if err != nil {\n        log.Fatal(err)\n    }\n    if res.XAAScopeServiceListResponse != nil {\n        // handle response\n    }\n}"
components:
  schemas:
    c1.api.cross_app_access.v1.XAAScopeServiceListResponse:
      description: XAAScopeServiceListResponse returns a page of scopes.
      properties:
        nextPageToken:
          description: Token for the next page, or empty if there are no more results.
          type: string
        scopes:
          description: The page of scopes.
          items:
            $ref: '#/components/schemas/c1.api.cross_app_access.v1.XAAScope'
          type:
            - array
            - 'null'
      title: Xaa Scope Service List Response
      type: object
      x-speakeasy-name-override: XAAScopeServiceListResponse
    c1.api.cross_app_access.v1.XAAScope:
      description: >-
        XAAScope is a single OAuth scope exposed by a resource server, elevated
        into
         a governable object bound to its own entitlement.
      properties:
        appEntitlementId:
          description: The AppEntitlement created for this scope.
          type: string
        appId:
          description: The application that owns the resource server.
          type: string
        classification:
          description: Risk classification.
          enum:
            - XAA_SCOPE_CLASSIFICATION_UNSPECIFIED
            - XAA_SCOPE_CLASSIFICATION_READ
            - XAA_SCOPE_CLASSIFICATION_WRITE
            - XAA_SCOPE_CLASSIFICATION_DESTRUCTIVE
            - XAA_SCOPE_CLASSIFICATION_SENSITIVE
            - XAA_SCOPE_CLASSIFICATION_DANGEROUS
          type: string
          x-speakeasy-unknown-values: allow
        createdAt:
          format: date-time
          type:
            - string
            - 'null'
        deletedAt:
          format: date-time
          type:
            - string
            - 'null'
        description:
          description: Description of what the scope grants.
          type: string
        displayName:
          description: Display name for the scope.
          type: string
        id:
          description: Unique identifier for this scope.
          type: string
        lastDiscoveredAt:
          format: date-time
          type:
            - string
            - 'null'
        scopeValue:
          description: >-
            The literal OAuth scope string minted into the grant. Immutable
            after
             creation (RFC 6749 charset, max 256 bytes).
          type: string
        source:
          description: How C1 learned of the scope.
          enum:
            - XAA_SCOPE_SOURCE_UNSPECIFIED
            - XAA_SCOPE_SOURCE_ADMIN_DECLARED
            - XAA_SCOPE_SOURCE_DISCOVERED
          type: string
          x-speakeasy-unknown-values: allow
        state:
          description: Approval/lifecycle state.
          enum:
            - XAA_SCOPE_STATE_UNSPECIFIED
            - XAA_SCOPE_STATE_PENDING_REVIEW
            - XAA_SCOPE_STATE_ENABLED
            - XAA_SCOPE_STATE_DISABLED
            - XAA_SCOPE_STATE_REMOVED
          type: string
          x-speakeasy-unknown-values: allow
        updatedAt:
          format: date-time
          type:
            - string
            - 'null'
        xaaResourceServerId:
          description: The resource server this scope belongs to.
          type: string
      title: Xaa Scope
      type: object
      x-speakeasy-name-override: XAAScope
  securitySchemes:
    bearerAuth:
      scheme: bearer
      type: http
    oauth:
      description: >-
        This API uses OAuth2 with the Client Credential flow.

        Client Credentials must be sent in the BODY, not the headers.

        For an example of how to implement this, refer to the
        [c1TokenSource.Token()](https://github.com/ConductorOne/conductorone-sdk-go/blob/3375fe7c0126d17e7ec4e711693dee7b791023aa/token_source.go#L101-L187)
        function.
      flows:
        clientCredentials:
          scopes: {}
          tokenUrl: /auth/v1/token
      type: oauth2

````