Get an installed app
const url = 'https://qinto-api.blotout.io/teams/7b8d1a52-6c1e-4b6f-9a30-2f8a54d1c3e9/domains/3f2a9c81-5d47-4e0b-8c66-91b2a7f04d15/apps/facebook-capi';const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
try { const response = await fetch(url, options); const data = await response.json(); console.log(data);} catch (error) { console.error(error);}curl --request GET \ --url https://qinto-api.blotout.io/teams/7b8d1a52-6c1e-4b6f-9a30-2f8a54d1c3e9/domains/3f2a9c81-5d47-4e0b-8c66-91b2a7f04d15/apps/facebook-capi \ --header 'Authorization: Bearer <token>'Returns one installed app in full: versions and switch, the developer’s legal documents, the approved capabilities, the settings each install takes, and each install’s stored values and configuration state. Call it before configuring an install. Secret values are write-only and never part of this shape.
Required permissions
domain:readon all domains, or on the addressed domain when its id is in the route
Authorizations
Section titled “Authorizations”Parameters
Section titled “Parameters”Path Parameters
Section titled “Path Parameters”Unique id (UUID) of the team that owns the addressed resources, as shown in the team settings on the Blotout platform.
Example
7b8d1a52-6c1e-4b6f-9a30-2f8a54d1c3e9Unique id (UUID) of the team that owns the addressed resources, as shown in the team settings on the Blotout platform.
Unique id (UUID) of the site, as returned by the site operations.
Example
3f2a9c81-5d47-4e0b-8c66-91b2a7f04d15Unique id (UUID) of the site, as returned by the site operations.
Immutable slug of the app, as shown by the list operation.
Example
facebook-capiImmutable slug of the app, as shown by the list operation.
Responses
Section titled “Responses”The installed app.
object
An app installed on a site, with its versions, switch, and install summary.
object
Server-assigned id of this installation.
Immutable slug the app runs under. Address it in the other site-app operations.
Display name of the app.
The app’s summary; null when not set.
What the app does with events: reshape them at ingest (transform), receive them after commit (destination), or both.
The consent category gating the app’s delivery on customer pages.
The app-level kill switch; a disabled app receives nothing.
The version selected for this site.
The version the site actually runs; null while the first deployment is pending.
Whether the deployed version ships an embedded UI panel; false while no version is deployed.
How many installs of the app the site has.
The installs’ labels, in install order.
How many app-permission requests involving this app await a decision.
The settings each install takes, as the version the site is set to declares them, in manifest order.
One setting a site manager fills in for each install of an app.
object
The name to send the value under when configuring an install.
A plain value is readable back; a secret one is write-only and never returned.
The value it takes: a string for text and password, a boolean for toggle, for select the value of one of options or an empty string for none, and for multiselect a list of options values, empty for none.
Display label the manifest gives the variable.
Whether an install stays inactive until it has a value.
One-line guidance the manifest supplies, or null when it supplies none.
Link to the vendor’s own documentation for this value, or null when the manifest supplies none.
The choices of a select or multiselect, in manifest order, or null for every other type.
One choice of a select or multiselect variable.
object
The value to send and the value stored when this option is picked.
The text a form shows for this option.
Whether a form pre-selects this option while the install has no value. The platform never stores a default on its own.
The developer’s legal documents, snapshotted with the installed version.
object
The developer’s terms for this app.
The developer’s privacy policy for this app.
What the installed version may do and see, as approved at install.
object
The site-API scopes the app may call with its own token.
The event-data buckets delivered to the app.
Whether the app supports more than one install per site.
The HTTP endpoints the deployed version declares; empty while no version is deployed. Each is served at https://<site domain>/app/<slug><path>, one URL for every install.
An HTTP endpoint the app declares, served on the site’s own domain.
object
The path the app declares, appended to /app/<slug>. A :name segment is a parameter matching one segment, so the URL is a pattern rather than a fixed address.
The HTTP methods the endpoint answers; any other method is refused before the app runs.
How the caller authenticates: public forwards unauthenticated for vendor webhooks, token requires a worker access token granting the request path the caller asked for, and that method, and visitor admits only the app’s own browser code, called by a site visitor.
How the request reaches the installs: webhook delivers it to every active install and acknowledges once, api passes the single install’s response through.
What the deployed version records against each visitor; both lists are empty while no version is deployed.
object
Query parameters the app records against each visitor, read from the page URL.
object
The name read from the page.
What the value is: attribution for a click or campaign id that ties a visit to its source, identity for a vendor id that names the visitor across visits.
How long a recorded value stays readable by the app, measured from the first time that value was seen. Absent means it is kept for the life of the visitor profile.
Cookies the app records against each visitor, read in the page. An HttpOnly cookie is never readable there.
object
The name read from the page.
What the value is: attribution for a click or campaign id that ties a visit to its source, identity for a vendor id that names the visitor across visits.
How long a recorded value stays readable by the app, measured from the first time that value was seen. Absent means it is kept for the life of the visitor profile.
The app’s installs on this site, in install order.
One install of an app on a site, with its configuration state and stored values.
object
Id of this install.
The install’s permanent ordinal; never reused after removal.
The label every surface shows for this install.
The install’s own switch, beneath the app-level one.
Where the install runs for visitors’ browser sessions. Each entry is an ISO 3166-1 alpha-2 country code (SI), EU for the European Union, or an ISO 3166-2 code for one of the 50 US states or the District of Columbia (US-CA). The install runs only when the visitor’s location is known, the include list is empty or one of its entries matches, and no exclude entry matches. A country code matches that country, EU matches a country in the European Union, and a state code matches a US visitor in that state. The location is unknown, and the install does not run, when the visitor’s country is not reported, when a list names a US state and a US visitor’s state is not reported, or when a list holds EU and the visitor’s location carries no EU flag. Server SDK events, schedules, webhooks, app endpoints, MCP tools and calls from other apps are not filtered.
object
Locations the install runs in; empty means every location the exclude list allows.
Locations the install never runs in.
Whether the install is dispatched to: both switches on and every required variable set.
Required variables the install has not completed; empty when fully configured.
Which secret variables are set. Secret values are write-only and never returned.
The stored plain values, keyed by variable name. Secrets never appear here; see secretsSet.
object
The value of a text, password or select variable.
The value of a toggle variable.
The value of a multiselect variable: option values in manifest order.
The permission requests involving this app on this site.
A private app-to-app permission request on this site.
object
Id of the permission request.
The app asking to call.
The calling app’s display name.
The app being called.
The called app’s display name.
The private functions the caller wants.
The site’s decision on the request.
Recent lifecycle-hook deliveries. Previous setting and secret snapshots are never returned.
Recent advisory lifecycle-hook delivery state.
object
Stable lifecycle event id and delivery idempotency key.
Lifecycle transition, or deleteRequest for a delete request, sent to the app.
Current best-effort delivery state.
Delivery attempts made so far.
Redacted last delivery error, when one exists.
When the lifecycle event was created, as an ISO 8601 UTC timestamp.
When the hook completed, or null until it succeeds.
Example
{ "app": { "domainAppId": "6c5b4a39-2817-4d6e-9f0a-1b2c3d4e5f6a", "slug": "facebook-capi", "name": "Facebook CAPI", "description": "Send events to the Facebook Conversions API.", "flows": [ "destination" ], "consentCategory": "marketing", "enabled": true, "desiredVersion": "1.4.1", "deployedVersion": "1.4.0", "ui": false, "installCount": 2, "installLabels": [ "Facebook (EU)", "Facebook (US)" ], "pendingGrantCount": 1 }, "variables": [ { "name": "PIXEL_ID", "kind": "plain", "type": "text", "label": "Pixel id", "required": true, "helpText": "Found under Data sources in Meta Events Manager.", "helpUrl": "https://developers.example.com/pixel-id", "options": null } ], "legal": { "termsUrl": "https://example.com/legal/terms", "privacyUrl": "https://example.com/legal/privacy" }, "capabilities": { "api": [ "track" ], "data": [ "customProperties" ] }, "multipleInstalls": true, "endpoints": [ { "path": "/webhook", "methods": [ "POST" ], "auth": "public", "mode": "webhook" } ], "capture": { "queryParams": [ { "name": "fbclid", "type": "attribution", "expiresInSeconds": 604800 } ], "cookies": [ { "name": "_fbp", "type": "identity" } ] }, "installs": [ { "appInstallId": "8d7c6b5a-4938-4271-a605-9e8f7a6b5c4d", "ordinal": 1, "label": "Facebook (EU)", "enabled": true, "geoFilter": { "include": [ "EU" ], "exclude": [] }, "active": false, "missingRequired": [ "ACCESS_TOKEN" ], "secretsSet": [ "ACCESS_TOKEN" ], "values": { "PIXEL_ID": "1234567890" } } ], "grants": [ { "appRpcGrantId": "9e8d7c6b-5a49-4382-b716-0f9e8d7c6b5a", "callerAppSlug": "facebook-capi", "callerAppName": "Facebook CAPI", "providerAppSlug": "consent-vault", "providerAppName": "Consent Vault", "functions": [ "record" ], "status": "pending" } ], "lifecycleDeliveries": [ { "eventId": "9e8d7c6b-5a49-4382-b716-0f9e8d7c6b5a", "type": "installed", "status": "pending", "attempts": 1, "lastError": "control_timeout", "createdAt": "2026-08-24T10:30:00.000Z", "deliveredAt": "2026-08-24T10:30:01.000Z" } ]}invalid_params — A path parameter failed validation (for example a malformed UUID); details pinpoints the offending parameter.
object
Machine-readable error slug; switch on this value rather than on the HTTP status alone.
Field-level validation errors: a tree keyed by input property, each node carrying an errors array of human-readable messages. Render it to help the caller correct the request.
object
Example
{ "error": "invalid_params", "details": { "errors": [], "properties": { "teamId": { "errors": [ "Invalid UUID" ] } } }}unauthenticated — The Authorization: Bearer token is missing, malformed, or no longer valid. Generate a team API token or obtain a new OAuth access token.
object
Machine-readable error slug; switch on this value rather than on the HTTP status alone.
Example
{ "error": "unauthenticated"}forbidden — The bearer credential lacks the required permission or belongs to another team, or its user lacks the organization role a developer operation needs. Update its policies, use a credential bound to the addressed team, or ask an organization owner for the role; message states the reason when one is known.
object
Machine-readable error slug; switch on this value rather than on the HTTP status alone.
Human-readable reason for this specific failure, intended for display — do not parse it programmatically.
Example
{ "error": "forbidden", "message": "The Cloudflare API token is invalid or expired."}not_found — The addressed resource does not exist within this team; check the id and retry.
object
Machine-readable error slug; switch on this value rather than on the HTTP status alone.
Example
{ "error": "not_found"}internal — Unexpected server error. Nothing is guaranteed to have been persisted; idempotent operations are safe to retry.
object
Machine-readable error slug; switch on this value rather than on the HTTP status alone.
Example
{ "error": "internal"}