Get an app

GET

/developer/organizations/{organizationId}/apps/{appId}

const url = 'https://qinto-api.blotout.io/developer/organizations/9c1d2b34-5e67-4f89-a0b1-2c3d4e5f6a7b/apps/5a6b7c8d-9e0f-4a1b-8c2d-3e4f5a6b7c8d';
const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request GET \
  --url https://qinto-api.blotout.io/developer/organizations/9c1d2b34-5e67-4f89-a0b1-2c3d4e5f6a7b/apps/5a6b7c8d-9e0f-4a1b-8c2d-3e4f5a6b7c8d \
  --header 'Authorization: Bearer <token>'

Returns one of the organization’s apps by id. Use it to refresh a single app after a change instead of re-listing them all.

Required permissions

None beyond a valid token; requires an OAuth token with the developer scope, for a user who belongs to the addressed organization

Authorizations

QintoAccessToken

Parameters

Path Parameters

organizationId

required

Unique id (UUID) of the organization that owns the addressed apps, as listed by GET /me under organizations.

string format: uuid

Example

9c1d2b34-5e67-4f89-a0b1-2c3d4e5f6a7b

Unique id (UUID) of the organization that owns the addressed apps, as listed by GET /me under organizations.

appId

required

Unique id (UUID) of the app, as returned by the create and list operations.

string format: uuid

Example

5a6b7c8d-9e0f-4a1b-8c2d-3e4f5a6b7c8d

Unique id (UUID) of the app, as returned by the create and list operations.

Responses

200

The addressed app.

application/json

object

app

required

A developer app owned by an organization. Versions of it are pushed with the Qinto CLI and installed on sites.

object

appId

required

Server-assigned unique id of the app. Address the app with it in the get, update and delete operations.

string

organizationId

required

Id of the organization that owns the app.

string

slug

required

Immutable identifier the app is addressed by everywhere it runs. Fixed at creation and reserved forever, even after the app is deleted.

string

name

required

Display name of the app, as shown on the Blotout platform.

string

description

required

Optional summary of what the app does, shown wherever the app is listed. Null when not set.

string | null

createdAt

required

When the app was registered, as an ISO 8601 UTC timestamp.

string format: date-time

updatedAt

required

When the app was last updated, as an ISO 8601 UTC timestamp.

string format: date-time

Example

{
  "app": {
    "appId": "5a6b7c8d-9e0f-4a1b-8c2d-3e4f5a6b7c8d",
    "organizationId": "9c1d2b34-5e67-4f89-a0b1-2c3d4e5f6a7b",
    "slug": "facebook-capi",
    "name": "Facebook CAPI",
    "description": "Send events to the Facebook Conversions API.",
    "createdAt": "2026-08-17T00:00:00.000Z",
    "updatedAt": "2026-08-17T00:00:00.000Z"
  }
}

400

invalid_params — A path parameter failed validation (for example a malformed UUID); details pinpoints the offending parameter.

application/json

object

error

required

Machine-readable error slug; switch on this value rather than on the HTTP status alone.

string

Allowed values: invalid_params

details

Field-level validation errors: a tree keyed by input property, each node carrying an errors array of human-readable messages. Render it to help the caller correct the request.

object

key

additional properties

Example

{
  "error": "invalid_params",
  "details": {
    "errors": [],
    "properties": {
      "teamId": {
        "errors": [
          "Invalid UUID"
        ]
      }
    }
  }
}

401

unauthenticated — The Authorization: Bearer token is missing, malformed, or no longer valid. Generate a team API token or obtain a new OAuth access token.

application/json

object

error

required

Machine-readable error slug; switch on this value rather than on the HTTP status alone.

string

Allowed values: unauthenticated

Example

{
  "error": "unauthenticated"
}

403

forbidden — The bearer credential lacks the required permission or belongs to another team, or its user lacks the organization role a developer operation needs. Update its policies, use a credential bound to the addressed team, or ask an organization owner for the role; message states the reason when one is known.

application/json

object

error

required

Machine-readable error slug; switch on this value rather than on the HTTP status alone.

string

Allowed values: forbidden

message

Human-readable reason for this specific failure, intended for display — do not parse it programmatically.

string

Example

{
  "error": "forbidden",
  "message": "The Cloudflare API token is invalid or expired."
}

404

not_found — The addressed resource does not exist within this team; check the id and retry.

application/json

object

error

required

Machine-readable error slug; switch on this value rather than on the HTTP status alone.

string

Allowed values: not_found

Example

{
  "error": "not_found"
}

500

internal — Unexpected server error. Nothing is guaranteed to have been persisted; idempotent operations are safe to retry.

application/json

object

error

required

Machine-readable error slug; switch on this value rather than on the HTTP status alone.

string

Allowed values: internal

Example

{
  "error": "internal"
}