List apps

GET

/developer/organizations/{organizationId}/apps

const url = 'https://qinto-api.blotout.io/developer/organizations/9c1d2b34-5e67-4f89-a0b1-2c3d4e5f6a7b/apps?cursorCreatedAt=2026-08-30T12%3A00%3A00.000Z&cursorId=7b8d1a52-6c1e-4b6f-9a30-2f8a54d1c3e9&limit=50';
const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request GET \
  --url 'https://qinto-api.blotout.io/developer/organizations/9c1d2b34-5e67-4f89-a0b1-2c3d4e5f6a7b/apps?cursorCreatedAt=2026-08-30T12%3A00%3A00.000Z&cursorId=7b8d1a52-6c1e-4b6f-9a30-2f8a54d1c3e9&limit=50' \
  --header 'Authorization: Bearer <token>'

Lists one page of the organization’s apps, newest first. Call it to discover the appId and slug the other app operations reference.

Required permissions

None beyond a valid token; requires an OAuth token with the developer scope, for a user who belongs to the addressed organization

Authorizations

QintoAccessToken

Parameters

Path Parameters

organizationId

required

Unique id (UUID) of the organization that owns the addressed apps, as listed by GET /me under organizations.

string format: uuid

Example

9c1d2b34-5e67-4f89-a0b1-2c3d4e5f6a7b

Unique id (UUID) of the organization that owns the addressed apps, as listed by GET /me under organizations.

Query Parameters

cursorCreatedAt

The nextCursor.createdAt of the previous page.

string format: date-time

Example

2026-08-30T12:00:00.000Z

The nextCursor.createdAt of the previous page.

cursorId

The nextCursor.id of the previous page.

string

Example

7b8d1a52-6c1e-4b6f-9a30-2f8a54d1c3e9

The nextCursor.id of the previous page.

limit

Page size, 1–200 (default 50).

integer

>= 1 <= 200

Example

Page size, 1–200 (default 50).

Responses

200

The organization’s apps.

application/json

object

apps

required

One page of the organization’s apps, newest first.

Array<object>

A developer app owned by an organization. Versions of it are pushed with the Qinto CLI and installed on sites.

object

appId

required

Server-assigned unique id of the app. Address the app with it in the get, update and delete operations.

string

organizationId

required

Id of the organization that owns the app.

string

slug

required

Immutable identifier the app is addressed by everywhere it runs. Fixed at creation and reserved forever, even after the app is deleted.

string

name

required

Display name of the app, as shown on the Blotout platform.

string

description

required

Optional summary of what the app does, shown wherever the app is listed. Null when not set.

string | null

createdAt

required

When the app was registered, as an ISO 8601 UTC timestamp.

string format: date-time

updatedAt

required

When the app was last updated, as an ISO 8601 UTC timestamp.

string format: date-time

nextCursor

required

Pass both fields as cursorCreatedAt / cursorId for the next page; null on the last page.

object

createdAt

required

Creation instant of the last listed app.

string

required

Id of the last listed app.

string

Example

{
  "apps": [
    {
      "appId": "5a6b7c8d-9e0f-4a1b-8c2d-3e4f5a6b7c8d",
      "organizationId": "9c1d2b34-5e67-4f89-a0b1-2c3d4e5f6a7b",
      "slug": "facebook-capi",
      "name": "Facebook CAPI",
      "description": "Send events to the Facebook Conversions API.",
      "createdAt": "2026-08-17T00:00:00.000Z",
      "updatedAt": "2026-08-17T00:00:00.000Z"
    }
  ],
  "nextCursor": {
    "createdAt": "2026-08-30T12:00:00.000Z",
    "id": "7b8d1a52-6c1e-4b6f-9a30-2f8a54d1c3e9"
  }
}

400

invalid_params — A path parameter failed validation (for example a malformed UUID); details pinpoints the offending parameter.

application/json

object

error

required

Machine-readable error slug; switch on this value rather than on the HTTP status alone.

string

Allowed values: invalid_params

details

Field-level validation errors: a tree keyed by input property, each node carrying an errors array of human-readable messages. Render it to help the caller correct the request.

object

key

additional properties

Example

{
  "error": "invalid_params",
  "details": {
    "errors": [],
    "properties": {
      "teamId": {
        "errors": [
          "Invalid UUID"
        ]
      }
    }
  }
}

401

unauthenticated — The Authorization: Bearer token is missing, malformed, or no longer valid. Generate a team API token or obtain a new OAuth access token.

application/json

object

error

required

Machine-readable error slug; switch on this value rather than on the HTTP status alone.

string

Allowed values: unauthenticated

Example

{
  "error": "unauthenticated"
}

403

forbidden — The bearer credential lacks the required permission or belongs to another team, or its user lacks the organization role a developer operation needs. Update its policies, use a credential bound to the addressed team, or ask an organization owner for the role; message states the reason when one is known.

application/json

object

error

required

Machine-readable error slug; switch on this value rather than on the HTTP status alone.

string

Allowed values: forbidden

message

Human-readable reason for this specific failure, intended for display — do not parse it programmatically.

string

Example

{
  "error": "forbidden",
  "message": "The Cloudflare API token is invalid or expired."
}

500

internal — Unexpected server error. Nothing is guaranteed to have been persisted; idempotent operations are safe to retry.

application/json

object

error

required

Machine-readable error slug; switch on this value rather than on the HTTP status alone.

string

Allowed values: internal

Example

{
  "error": "internal"
}