List app sites

GET

/developer/organizations/{organizationId}/apps/{appId}/sites

const url = 'https://qinto-api.blotout.io/developer/organizations/9c1d2b34-5e67-4f89-a0b1-2c3d4e5f6a7b/apps/5a6b7c8d-9e0f-4a1b-8c2d-3e4f5a6b7c8d/sites?search=shop.example&limit=50&cursorCreatedAt=2026-08-17T12%3A00%3A00.000Z&cursorId=7b8d1a52-6c1e-4b6f-9a30-2f8a54d1c3e9';
const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request GET \
  --url 'https://qinto-api.blotout.io/developer/organizations/9c1d2b34-5e67-4f89-a0b1-2c3d4e5f6a7b/apps/5a6b7c8d-9e0f-4a1b-8c2d-3e4f5a6b7c8d/sites?search=shop.example&limit=50&cursorCreatedAt=2026-08-17T12%3A00%3A00.000Z&cursorId=7b8d1a52-6c1e-4b6f-9a30-2f8a54d1c3e9' \
  --header 'Authorization: Bearer <token>'

Lists the sites running an app, newest installation first, with the version each is on. Filter by domain with search, and pass the returned nextCursor fields back as query parameters to page.

Required permissions

None beyond a valid token; requires an OAuth token with the developer scope, for a user who belongs to the addressed organization

Authorizations

QintoAccessToken

Parameters

Path Parameters

organizationId

required

Unique id (UUID) of the organization that owns the addressed apps, as listed by GET /me under organizations.

string format: uuid

Example

9c1d2b34-5e67-4f89-a0b1-2c3d4e5f6a7b

Unique id (UUID) of the organization that owns the addressed apps, as listed by GET /me under organizations.

appId

required

Unique id (UUID) of the app, as returned by the create and list operations.

string format: uuid

Example

5a6b7c8d-9e0f-4a1b-8c2d-3e4f5a6b7c8d

Unique id (UUID) of the app, as returned by the create and list operations.

Query Parameters

search

Case-insensitive substring to match against each site’s root domain and first-party domain.

string

<= 200 characters

Example

shop.example

Case-insensitive substring to match against each site’s root domain and first-party domain.

limit

Page size, 1-200. Defaults to 50.

integer

>= 1 <= 200

Example

Page size, 1-200. Defaults to 50.

cursorCreatedAt

The nextCursor.createdAt from the previous page.

string

Example

2026-08-17T12:00:00.000Z

The nextCursor.createdAt from the previous page.

cursorId

The nextCursor.id from the previous page.

string

Example

7b8d1a52-6c1e-4b6f-9a30-2f8a54d1c3e9

The nextCursor.id from the previous page.

Responses

200

A page of sites with the cursor to continue from.

application/json

object

sites

required

One page of sites running the app, newest installation first.

Array<object>

One live site running a developer app, as the app’s developer sees it.

object

domainAppId

required

Server-assigned id of the app’s installation record on this site.

string

domainId

required

Id of the site. Address the site with it in the get site and configure install operations.

string

domain

required

The site’s first-party hostname the app runs under.

string

version

required

The app version the site is on.

string

enabled

required

Whether the site manager has the app switched on.

boolean

installedAt

required

When the site installed the app, as an ISO 8601 UTC timestamp.

string format: date-time

nextCursor

required

Pass both fields as cursorCreatedAt / cursorId for the next page; null on the last page.

object

createdAt

required

Installation instant of the last listed site.

string

required

Installation record id of the last listed site.

string

Example

{
  "sites": [
    {
      "domainAppId": "7b8d1a52-6c1e-4b6f-9a30-2f8a54d1c3e9",
      "domainId": "3f2a9c81-5d47-4e0b-8c66-91b2a7f04d15",
      "domain": "q.shop.example.com",
      "version": "1.4.1",
      "enabled": true,
      "installedAt": "2026-08-17T12:00:00.000Z"
    }
  ],
  "nextCursor": {
    "createdAt": "2026-08-17T12:00:00.000Z",
    "id": "7b8d1a52-6c1e-4b6f-9a30-2f8a54d1c3e9"
  }
}

400

invalid_params — A path parameter failed validation (for example a malformed UUID); details pinpoints the offending parameter.

application/json

object

error

required

Machine-readable error slug; switch on this value rather than on the HTTP status alone.

string

Allowed values: invalid_params

details

Field-level validation errors: a tree keyed by input property, each node carrying an errors array of human-readable messages. Render it to help the caller correct the request.

object

key

additional properties

Example

{
  "error": "invalid_params",
  "details": {
    "errors": [],
    "properties": {
      "teamId": {
        "errors": [
          "Invalid UUID"
        ]
      }
    }
  }
}

401

unauthenticated — The Authorization: Bearer token is missing, malformed, or no longer valid. Generate a team API token or obtain a new OAuth access token.

application/json

object

error

required

Machine-readable error slug; switch on this value rather than on the HTTP status alone.

string

Allowed values: unauthenticated

Example

{
  "error": "unauthenticated"
}

403

forbidden — The bearer credential lacks the required permission or belongs to another team, or its user lacks the organization role a developer operation needs. Update its policies, use a credential bound to the addressed team, or ask an organization owner for the role; message states the reason when one is known.

application/json

object

error

required

Machine-readable error slug; switch on this value rather than on the HTTP status alone.

string

Allowed values: forbidden

message

Human-readable reason for this specific failure, intended for display — do not parse it programmatically.

string

Example

{
  "error": "forbidden",
  "message": "The Cloudflare API token is invalid or expired."
}

404

not_found — The addressed resource does not exist within this team; check the id and retry.

application/json

object

error

required

Machine-readable error slug; switch on this value rather than on the HTTP status alone.

string

Allowed values: not_found

Example

{
  "error": "not_found"
}

500

internal — Unexpected server error. Nothing is guaranteed to have been persisted; idempotent operations are safe to retry.

application/json

object

error

required

Machine-readable error slug; switch on this value rather than on the HTTP status alone.

string

Allowed values: internal

Example

{
  "error": "internal"
}