Get an app site

GET

/developer/organizations/{organizationId}/apps/{appId}/sites/{domainId}

const url = 'https://qinto-api.blotout.io/developer/organizations/9c1d2b34-5e67-4f89-a0b1-2c3d4e5f6a7b/apps/5a6b7c8d-9e0f-4a1b-8c2d-3e4f5a6b7c8d/sites/3f2a9c81-5d47-4e0b-8c66-91b2a7f04d15';
const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request GET \
  --url https://qinto-api.blotout.io/developer/organizations/9c1d2b34-5e67-4f89-a0b1-2c3d4e5f6a7b/apps/5a6b7c8d-9e0f-4a1b-8c2d-3e4f5a6b7c8d/sites/3f2a9c81-5d47-4e0b-8c66-91b2a7f04d15 \
  --header 'Authorization: Bearer <token>'

Reads one site running the app: its installations and, on each, the state of the variables the manifest hands to the developer. Site-managed values and secret values are never returned.

Required permissions

None beyond a valid token; requires an OAuth token with the developer scope, for a user who belongs to the addressed organization

Authorizations

QintoAccessToken

Parameters

Path Parameters

organizationId

required

Unique id (UUID) of the organization that owns the addressed apps, as listed by GET /me under organizations.

string format: uuid

Example

9c1d2b34-5e67-4f89-a0b1-2c3d4e5f6a7b

Unique id (UUID) of the organization that owns the addressed apps, as listed by GET /me under organizations.

appId

required

Unique id (UUID) of the app, as returned by the create and list operations.

string format: uuid

Example

5a6b7c8d-9e0f-4a1b-8c2d-3e4f5a6b7c8d

Unique id (UUID) of the app, as returned by the create and list operations.

domainId

required

Unique id (UUID) of the site, as returned by the list sites operation.

string format: uuid

Example

3f2a9c81-5d47-4e0b-8c66-91b2a7f04d15

Unique id (UUID) of the site, as returned by the list sites operation.

Responses

200

The site, its installations, and their developer-owned variables.

application/json

object

site

required

A site running the app, its installations, and the developer-owned variables on each.

object

domainAppId

required

Server-assigned id of the app’s installation record on this site.

string

domainId

required

Id of the site. Address the site with it in the get site and configure install operations.

string

domain

required

The site’s first-party hostname the app runs under.

string

version

required

The app version the site is on.

string

enabled

required

Whether the site manager has the app switched on.

boolean

installedAt

required

When the site installed the app, as an ISO 8601 UTC timestamp.

string format: date-time

variables

required

The developer-owned variables the site’s version declares, in manifest order. Empty when it declares none.

Array<object>

One per-install setting the app’s manifest hands to the developer (owner: "developer"). A site manager never sees it; the developer sets it per install.

object

name

required

Name the app’s manifest declares the variable under, and the name to send when setting its value.

string

kind

required

Where the value is stored: a plain value is readable back, a secret one is write-only and never returned.

string

Allowed values: plain secret

type

required

How a form should render the input. A toggle takes a boolean value; a select takes the value of one of options, or an empty string for none; a multiselect takes a list of options values, empty for none; the others take a string.

string

Allowed values: text password toggle select multiselect

label

required

Display label the manifest gives the variable.

string

browser

required

Whether the value also ships into the site’s browser bundle.

boolean

helpText

required

One-line guidance the manifest supplies, or null when it supplies none.

string | null

helpUrl

required

Link to further documentation, or null when the manifest supplies none.

string | null

options

required

The choices of a select or multiselect, in manifest order, or null for every other type.

Array<object> | null

One choice of a select or multiselect variable.

object

value

required

The value to send and the value stored when this option is picked.

string

label

required

The text a form shows for this option.

string

default

required

Whether a form pre-selects this option while the install has no value. The platform never stores a default on its own.

boolean

installs

required

The live installations on the site, in ordinal order.

Array<object>

One installation of the app on a site, with the developer-owned state of its variables.

object

appInstallId

required

Id of the installation. Address it with the configure install operation.

string

ordinal

required

Position of the installation on the site, from 1.

integer

label

required

The label the site manager gave the installation.

string

enabled

required

Whether the site manager has this installation switched on.

boolean

variables

required

The stored values of the developer-owned plain variables, keyed by name. A name with no value is absent.

object

key

additional properties

Any of:

The value of a text, password or select variable.

string

The value of a toggle variable.

boolean

The value of a multiselect variable: option values in manifest order.

Array<string>

secretsSet

required

The developer-owned secret variables that hold a value. Values are never returned.

Array<string>

Example

{
  "site": {
    "domainAppId": "7b8d1a52-6c1e-4b6f-9a30-2f8a54d1c3e9",
    "domainId": "3f2a9c81-5d47-4e0b-8c66-91b2a7f04d15",
    "domain": "q.shop.example.com",
    "version": "1.4.1",
    "enabled": true,
    "installedAt": "2026-08-17T12:00:00.000Z",
    "variables": [
      {
        "name": "BETA_CHECKOUT",
        "kind": "plain",
        "type": "text",
        "label": "Beta checkout",
        "browser": false,
        "helpText": "Turns on the redesigned checkout for this site.",
        "helpUrl": "https://developers.example.com/beta-checkout",
        "options": null
      }
    ],
    "installs": [
      {
        "appInstallId": "8d7c6b5a-4938-4271-a605-9e8f7a6b5c4d",
        "ordinal": 1,
        "label": "EU pixel",
        "enabled": true,
        "variables": {
          "BETA_CHECKOUT": true
        },
        "secretsSet": [
          "BETA_KEY"
        ]
      }
    ]
  }
}

400

invalid_params — A path parameter failed validation (for example a malformed UUID); details pinpoints the offending parameter.

application/json

object

error

required

Machine-readable error slug; switch on this value rather than on the HTTP status alone.

string

Allowed values: invalid_params

details

Field-level validation errors: a tree keyed by input property, each node carrying an errors array of human-readable messages. Render it to help the caller correct the request.

object

key

additional properties

Example

{
  "error": "invalid_params",
  "details": {
    "errors": [],
    "properties": {
      "teamId": {
        "errors": [
          "Invalid UUID"
        ]
      }
    }
  }
}

401

unauthenticated — The Authorization: Bearer token is missing, malformed, or no longer valid. Generate a team API token or obtain a new OAuth access token.

application/json

object

error

required

Machine-readable error slug; switch on this value rather than on the HTTP status alone.

string

Allowed values: unauthenticated

Example

{
  "error": "unauthenticated"
}

403

forbidden — The bearer credential lacks the required permission or belongs to another team, or its user lacks the organization role a developer operation needs. Update its policies, use a credential bound to the addressed team, or ask an organization owner for the role; message states the reason when one is known.

application/json

object

error

required

Machine-readable error slug; switch on this value rather than on the HTTP status alone.

string

Allowed values: forbidden

message

Human-readable reason for this specific failure, intended for display — do not parse it programmatically.

string

Example

{
  "error": "forbidden",
  "message": "The Cloudflare API token is invalid or expired."
}

404

not_found — The addressed resource does not exist within this team; check the id and retry.

application/json

object

error

required

Machine-readable error slug; switch on this value rather than on the HTTP status alone.

string

Allowed values: not_found

Example

{
  "error": "not_found"
}

500

internal — Unexpected server error. Nothing is guaranteed to have been persisted; idempotent operations are safe to retry.

application/json

object

error

required

Machine-readable error slug; switch on this value rather than on the HTTP status alone.

string

Allowed values: internal

Example

{
  "error": "internal"
}