Get an app store app
const url = 'https://qinto-api.blotout.io/app-store/apps/facebook-capi';const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
try { const response = await fetch(url, options); const data = await response.json(); console.log(data);} catch (error) { console.error(error);}curl --request GET \ --url https://qinto-api.blotout.io/app-store/apps/facebook-capi \ --header 'Authorization: Bearer <token>'Returns one app store app with its full listing: the description, the features, the screenshots, the publisher’s links, and what its newest approved version may do on a site. Call it before you install an app.
How it works
facts describes the newest approved version, and versions lists every approved one. not_found means no app has this slug, or the app is not in the app store.
Required permissions
- None beyond a valid token; requires an OAuth token whose user belongs to a team
Authorizations
Section titled “Authorizations”Parameters
Section titled “Parameters”Path Parameters
Section titled “Path Parameters”Slug of the app, as the search operation returns it.
Example
facebook-capiSlug of the app, as the search operation returns it.
Responses
Section titled “Responses”The app and its listing.
An app in the app store, with its full listing.
object
The app’s slug, to pass as appSlug.
The app’s display name.
One line on what the app does.
Display name of the organization that publishes the app.
The categories the app is listed in.
The long description of the app.
The features the publisher highlights, in listing order.
object
The feature’s heading.
What the feature does.
Where to ask the publisher for help: an email address or a URL.
The publisher’s page for the app, or null when none is given.
The app’s documentation, or null when none is given.
The captions of the listing’s screenshots, in listing order. The API does not serve the images.
object
What the screenshot shows.
What the newest approved version declares.
object
The newest approved version, which the other facts describe.
What the app may do and see on a site.
object
The site-API scopes the app may call with its own token.
The event-data buckets delivered to the app.
The visitor consent the app runs under.
Where the app plugs into the event pipeline.
The vendor accounts an install connects to.
The tools the app offers to AI assistants.
The app roles a team can give its members; absent when the app declares none.
object
The role’s name.
What the role may do in the app, when the app says.
Whether the app runs code that is not part of the app, such as code a merchant writes or an AI generates, in an isolated sandbox.
The publisher’s terms of service.
The publisher’s privacy policy.
The approved versions, newest first, 50 at most.
object
The version number.
When the version was approved for the app store; null when the time was not recorded.
Example
{ "slug": "facebook-capi", "name": "Facebook CAPI", "tagline": "Send conversions to Meta from your server.", "publisher": "Acme Dev", "categories": [ "advertising" ], "description": "Sends purchase and lead events to Meta.", "features": [ { "title": "Server-side delivery", "text": "Events reach Meta even when the browser blocks the pixel." } ], "supportContact": "support@acme.example", "websiteUrl": "https://acme.example/capi", "documentationUrl": "https://acme.example/docs/capi", "screenshots": [ { "caption": "The event overview." } ], "facts": { "version": "1.4.1", "capabilities": { "api": [ "track" ], "data": [ "customProperties" ] }, "consentCategory": "marketing", "flows": [ "destination" ], "vendors": [ "Meta" ], "tools": [ "list_audiences" ], "roles": [ { "key": "viewer", "description": "Reads reports." } ], "runsCustomCode": false, "termsUrl": "https://acme.example/terms", "privacyUrl": "https://acme.example/privacy" }, "versions": [ { "version": "1.4.1", "approvedAt": "2026-09-30T12:00:00.000Z" } ]}invalid_params — A path parameter failed validation (for example a malformed UUID); details pinpoints the offending parameter.
object
Machine-readable error slug; switch on this value rather than on the HTTP status alone.
Field-level validation errors: a tree keyed by input property, each node carrying an errors array of human-readable messages. Render it to help the caller correct the request.
object
Example
{ "error": "invalid_params", "details": { "errors": [], "properties": { "teamId": { "errors": [ "Invalid UUID" ] } } }}unauthenticated — The Authorization: Bearer token is missing, malformed, or no longer valid. Generate a team API token or obtain a new OAuth access token.
object
Machine-readable error slug; switch on this value rather than on the HTTP status alone.
Example
{ "error": "unauthenticated"}forbidden — The bearer credential lacks the required permission or belongs to another team, or its user lacks the organization role a developer operation needs. Update its policies, use a credential bound to the addressed team, or ask an organization owner for the role; message states the reason when one is known.
object
Machine-readable error slug; switch on this value rather than on the HTTP status alone.
Human-readable reason for this specific failure, intended for display — do not parse it programmatically.
Example
{ "error": "forbidden", "message": "The Cloudflare API token is invalid or expired."}not_found — The addressed resource does not exist within this team; check the id and retry.
object
Machine-readable error slug; switch on this value rather than on the HTTP status alone.
Example
{ "error": "not_found"}internal — Unexpected server error. Nothing is guaranteed to have been persisted; idempotent operations are safe to retry.
object
Machine-readable error slug; switch on this value rather than on the HTTP status alone.
Example
{ "error": "internal"}