Create an app
const url = 'https://qinto-api.blotout.io/developer/organizations/9c1d2b34-5e67-4f89-a0b1-2c3d4e5f6a7b/apps';const options = { method: 'POST', headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'}, body: '{"slug":"facebook-capi","name":"Facebook CAPI","description":"Send events to the Facebook Conversions API."}'};
try { const response = await fetch(url, options); const data = await response.json(); console.log(data);} catch (error) { console.error(error);}curl --request POST \ --url https://qinto-api.blotout.io/developer/organizations/9c1d2b34-5e67-4f89-a0b1-2c3d4e5f6a7b/apps \ --header 'Authorization: Bearer <token>' \ --header 'Content-Type: application/json' \ --data '{ "slug": "facebook-capi", "name": "Facebook CAPI", "description": "Send events to the Facebook Conversions API." }'Registers an app under the organization. The returned appId is what the other app operations reference; the slug is the identity the app runs under on every site.
How it works
The slug is fixed at creation and can never be changed or reused: it stays reserved even after the app is deleted, so slug_taken can name an app that no longer exists. The name and description stay editable.
Required permissions
- None beyond a valid token; requires an OAuth token with the
developerscope, for an owner or developer of the addressed organization
Authorizations
Section titled “Authorizations”Parameters
Section titled “Parameters”Path Parameters
Section titled “Path Parameters”Unique id (UUID) of the organization that owns the addressed apps, as listed by GET /me under organizations.
Example
9c1d2b34-5e67-4f89-a0b1-2c3d4e5f6a7bUnique id (UUID) of the organization that owns the addressed apps, as listed by GET /me under organizations.
Request Bodyrequired
Section titled “Request Bodyrequired”The new app’s slug, name, and optional description.
object
3-30 lowercase letters, digits, and hyphens, starting with a letter and not ending with a hyphen. Immutable and globally unique; once used it stays reserved forever, even after the app is deleted.
Example
facebook-capiDisplay name of the app, 1-100 characters.
Example
Facebook CAPIOptional summary of what the app does, at most 500 characters. Omit to leave it unset.
Example
Send events to the Facebook Conversions API.Responses
Section titled “Responses”The app was registered; the response echoes its stored representation.
object
A developer app owned by an organization. Versions of it are pushed with the Qinto CLI and installed on sites.
object
Server-assigned unique id of the app. Address the app with it in the get, update and delete operations.
Id of the organization that owns the app.
Immutable identifier the app is addressed by everywhere it runs. Fixed at creation and reserved forever, even after the app is deleted.
Display name of the app, as shown on the Blotout platform.
Optional summary of what the app does, shown wherever the app is listed. Null when not set.
When the app was registered, as an ISO 8601 UTC timestamp.
When the app was last updated, as an ISO 8601 UTC timestamp.
Example
{ "app": { "appId": "5a6b7c8d-9e0f-4a1b-8c2d-3e4f5a6b7c8d", "organizationId": "9c1d2b34-5e67-4f89-a0b1-2c3d4e5f6a7b", "slug": "facebook-capi", "name": "Facebook CAPI", "description": "Send events to the Facebook Conversions API.", "createdAt": "2026-08-17T00:00:00.000Z", "updatedAt": "2026-08-17T00:00:00.000Z" }}invalid_params — A path parameter failed validation (for example a malformed UUID); details pinpoints the offending parameter. invalid_body — The JSON body is unparseable or failed schema validation; details pinpoints the offending fields when the body could be parsed. invalid_app — The app details were rejected — a malformed or reserved slug, or a name or description that is too long. message states which.
object
Machine-readable error slug; switch on this value rather than on the HTTP status alone.
Human-readable reason for this specific failure, intended for display — do not parse it programmatically.
Field-level validation errors: a tree keyed by input property, each node carrying an errors array of human-readable messages. Render it to help the caller correct the request.
object
Example
{ "error": "invalid_params", "message": "The Cloudflare API token is invalid or expired.", "details": { "errors": [], "properties": { "teamId": { "errors": [ "Invalid UUID" ] } } }}unauthenticated — The Authorization: Bearer token is missing, malformed, or no longer valid. Generate a team API token or obtain a new OAuth access token.
object
Machine-readable error slug; switch on this value rather than on the HTTP status alone.
Example
{ "error": "unauthenticated"}forbidden — The bearer credential lacks the required permission or belongs to another team, or its user lacks the organization role a developer operation needs. Update its policies, use a credential bound to the addressed team, or ask an organization owner for the role; message states the reason when one is known.
object
Machine-readable error slug; switch on this value rather than on the HTTP status alone.
Human-readable reason for this specific failure, intended for display — do not parse it programmatically.
Example
{ "error": "forbidden", "message": "The Cloudflare API token is invalid or expired."}slug_taken — The slug is already in use. Slugs are permanent and stay reserved even after an app is deleted, so choose a different one.
object
Machine-readable error slug; switch on this value rather than on the HTTP status alone.
Human-readable reason for this specific failure, intended for display — do not parse it programmatically.
Example
{ "error": "slug_taken", "message": "The Cloudflare API token is invalid or expired."}internal — Unexpected server error. Nothing is guaranteed to have been persisted; idempotent operations are safe to retry.
object
Machine-readable error slug; switch on this value rather than on the HTTP status alone.
Example
{ "error": "internal"}