List app variables

GET

/developer/organizations/{organizationId}/apps/{appId}/variables

const url = 'https://qinto-api.blotout.io/developer/organizations/9c1d2b34-5e67-4f89-a0b1-2c3d4e5f6a7b/apps/5a6b7c8d-9e0f-4a1b-8c2d-3e4f5a6b7c8d/variables';
const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request GET \
  --url https://qinto-api.blotout.io/developer/organizations/9c1d2b34-5e67-4f89-a0b1-2c3d4e5f6a7b/apps/5a6b7c8d-9e0f-4a1b-8c2d-3e4f5a6b7c8d/variables \
  --header 'Authorization: Bearer <token>'

Lists the app-scope variables the app declares, with the value stored for each. These are the developer’s own settings — one value per app, delivered identically to every site that installs it — not the per-install variables a site manager fills in.

How it works

A secret’s value is always null; use set to tell a stored secret from an unset one. The list unions every version the app has, so a name an older version declared stays visible while sites still run it.

Required permissions

None beyond a valid token; requires an OAuth token with the developer scope, for a user who belongs to the addressed organization

Authorizations

QintoAccessToken

Parameters

Path Parameters

organizationId

required

Unique id (UUID) of the organization that owns the addressed apps, as listed by GET /me under organizations.

string format: uuid

Example

9c1d2b34-5e67-4f89-a0b1-2c3d4e5f6a7b

Unique id (UUID) of the organization that owns the addressed apps, as listed by GET /me under organizations.

appId

required

Unique id (UUID) of the app, as returned by the create and list operations.

string format: uuid

Example

5a6b7c8d-9e0f-4a1b-8c2d-3e4f5a6b7c8d

Unique id (UUID) of the app, as returned by the create and list operations.

Responses

200

The app’s app-scope variables.

application/json

object

variables

required

Every app-scope variable any version of the app declares, in the order the earliest version that declares each one lists it. Empty when no version declares any.

Array<object>

One app-scope setting: a value the developer sets once for the app, delivered identically to every site that installs it. Distinct from a site app’s per-install variables, which a site manager fills in.

object

name

required

Name the app’s manifest declares the variable under, and the name to send when setting its value.

string

kind

required

Where the value is stored: a plain value is readable back, a secret one is write-only and never returned.

string

Allowed values: plain secret

type

required

How a form should render the input for this variable.

string

Allowed values: text password

label

required

Display label the manifest gives the variable.

string

required

required

Whether a version that declares this variable refuses to publish until it has a value.

boolean

helpText

required

One-line guidance the manifest supplies, or null when it supplies none.

string | null

helpUrl

required

Link to the vendor’s own documentation for this value, or null when the manifest supplies none.

string | null

value

required

The stored value for a plain variable, or null when it has none. Always null for a secret variable.

string | null

set

required

Whether a value is stored for this variable.

boolean

Example

{
  "variables": [
    {
      "name": "META_APP_SECRET",
      "kind": "plain",
      "type": "text",
      "label": "Meta app secret",
      "required": true,
      "helpText": "Found under App settings in the Meta developer console.",
      "helpUrl": "https://developers.example.com/app-secret",
      "value": "https://api.example.com",
      "set": true
    }
  ]
}

400

invalid_params — A path parameter failed validation (for example a malformed UUID); details pinpoints the offending parameter.

application/json

object

error

required

Machine-readable error slug; switch on this value rather than on the HTTP status alone.

string

Allowed values: invalid_params

details

Field-level validation errors: a tree keyed by input property, each node carrying an errors array of human-readable messages. Render it to help the caller correct the request.

object

key

additional properties

Example

{
  "error": "invalid_params",
  "details": {
    "errors": [],
    "properties": {
      "teamId": {
        "errors": [
          "Invalid UUID"
        ]
      }
    }
  }
}

401

unauthenticated — The Authorization: Bearer token is missing, malformed, or no longer valid. Generate a team API token or obtain a new OAuth access token.

application/json

object

error

required

Machine-readable error slug; switch on this value rather than on the HTTP status alone.

string

Allowed values: unauthenticated

Example

{
  "error": "unauthenticated"
}

403

forbidden — The bearer credential lacks the required permission or belongs to another team, or its user lacks the organization role a developer operation needs. Update its policies, use a credential bound to the addressed team, or ask an organization owner for the role; message states the reason when one is known.

application/json

object

error

required

Machine-readable error slug; switch on this value rather than on the HTTP status alone.

string

Allowed values: forbidden

message

Human-readable reason for this specific failure, intended for display — do not parse it programmatically.

string

Example

{
  "error": "forbidden",
  "message": "The Cloudflare API token is invalid or expired."
}

404

not_found — The addressed resource does not exist within this team; check the id and retry.

application/json

object

error

required

Machine-readable error slug; switch on this value rather than on the HTTP status alone.

string

Allowed values: not_found

Example

{
  "error": "not_found"
}

500

internal — Unexpected server error. Nothing is guaranteed to have been persisted; idempotent operations are safe to retry.

application/json

object

error

required

Machine-readable error slug; switch on this value rather than on the HTTP status alone.

string

Allowed values: internal

Example

{
  "error": "internal"
}