List a purchase’s apps
const url = 'https://qinto-api.blotout.io/teams/7b8d1a52-6c1e-4b6f-9a30-2f8a54d1c3e9/bundle-purchases/9c1d2e3f-4a5b-4c6d-8e7f-0a1b2c3d4e5f/apps';const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
try { const response = await fetch(url, options); const data = await response.json(); console.log(data);} catch (error) { console.error(error);}curl --request GET \ --url https://qinto-api.blotout.io/teams/7b8d1a52-6c1e-4b6f-9a30-2f8a54d1c3e9/bundle-purchases/9c1d2e3f-4a5b-4c6d-8e7f-0a1b2c3d4e5f/apps \ --header 'Authorization: Bearer <token>'Reads a bundle purchase with the apps it covers right now and the sites each one is installed on. Call it to choose what to install with the install operation, at no charge beyond the bundle.
How it works
The apps are those of the bundle’s developer that the purchase covers, with the version an install would take and whether that version runs without visitor consent. An app that joined the bundle after the purchase is listed like any other. An ended purchase lists no app. Only a token with a user reads; a team API token is refused.
Required permissions
team:readon the team
Authorizations
Section titled “Authorizations”Parameters
Section titled “Parameters”Path Parameters
Section titled “Path Parameters”Unique id (UUID) of the team that owns the addressed resources, as shown in the team settings on the Blotout platform.
Example
7b8d1a52-6c1e-4b6f-9a30-2f8a54d1c3e9Unique id (UUID) of the team that owns the addressed resources, as shown in the team settings on the Blotout platform.
Unique id (UUID) of the purchase, as the list operation returns it.
Example
9c1d2e3f-4a5b-4c6d-8e7f-0a1b2c3d4e5fUnique id (UUID) of the purchase, as the list operation returns it.
Responses
Section titled “Responses”The purchase and its apps.
object
A team’s holding of one bundle, with the terms copied when it bought it and the sites it chose.
object
Id of the purchase.
The team that holds it.
The bundle bought.
The bundle’s current name.
The developer organization’s name.
The bundle link the purchase came through; null from the app store.
The pricing model copied at purchase.
The price per interval copied at purchase, in US cents.
How often the price is charged.
The free days copied at purchase; null or 0 for none.
The price per interval of each site past the limit; null when none are sold.
The services copied at purchase.
A service the developer delivers, which the bundle price covers.
object
Name of the service. Empty only on a bundle that isn’t published yet.
What the team gets. Empty when not set.
What the service costs on its own, in US cents. Null only on a bundle that isn’t published yet.
How the price on its own is billed.
The most usage adds to the bill each month, in US cents.
The priced meters copied at purchase.
What one meter of one app costs on a bundle. A meter with no term is free.
object
Id of the app that reports the meter.
Key of the meter in that app. The same key in two apps is two terms.
Name of the meter on the bundle.
Plural unit, as the bill shows it. Empty only on a bundle that isn’t published yet.
Units included each month for the whole team, across its sites.
Price past the included amount, in US micro-dollars.
How many units that price covers. Null only on a bundle that isn’t published yet.
The app mode copied at purchase.
The bundle’s stored app list copied at purchase; empty for All apps.
The sites the purchase covers, A–Z by hostname.
object
Id of the site.
The site’s hostname.
Who accepted the apps’ terms.
When the terms were accepted.
Who approved the charge; null for a free bundle.
When the charge was approved; null for a free bundle.
The purchase instant. Charges start the next UTC day.
When the purchase ends: the first instant it no longer covers, still ahead while a cancel waits to take effect; null while active.
The apps the purchase covers right now, A–Z by name; empty once it ended.
One app a bundle purchase covers, and where it is installed.
object
Id of the app.
Slug of the app, to pass to the install operation.
Display name of the app.
Content hash of the app’s icon; null when it has none.
The version an install takes: the newest the sites may run.
Whether that version runs without visitor consent, so its slug must be in acknowledgeNecessary.
The developer’s legal documents, accepted when the bundle was bought.
object
The developer’s terms for the app.
The developer’s privacy policy for the app.
Ids of the purchase’s sites that already run the app.
Example
{ "purchase": { "bundlePurchaseId": "9c1d2e3f-4a5b-4c6d-8e7f-0a1b2c3d4e5f", "teamId": "7b8d1a52-6c1e-4b6f-9a30-2f8a54d1c3e9", "bundleId": "2b7e4d10-8a3c-4f56-9e21-7c0d5b8f3a64", "bundleName": "Growth Stack", "publisher": "Acme Dev", "linkId": null, "pricingModel": "fixed", "basePriceCents": 2900, "billingInterval": "monthly", "trialDays": 14, "siteLimit": 3, "extraSitePriceCents": 500, "services": [ { "name": "Priority support", "detail": "4-hour response, shared Slack channel", "priceCents": 20000, "basis": "monthly" } ], "usageCapCents": 10000, "meterTerms": [ { "appId": "7f3a1c92-4b6d-4e8a-b1d3-5c9e2f7a6b10", "key": "events", "name": "Events", "unit": "events", "includedAmount": 100000, "priceMicros": 500000, "perUnits": 1000 } ], "appMode": "selected", "appIds": [], "sites": [ { "domainId": "3f2a9c81-5d47-4e0b-8c66-91b2a7f04d15", "domain": "q.shop.example.com" } ], "termsAcceptedByUserId": "1f2e3d4c-5b6a-4978-8f0e-9d8c7b6a5f4e", "termsAcceptedAt": "2026-11-08T12:00:00.000Z", "chargeApprovedByUserId": null, "chargeApprovedAt": "2026-11-08T12:00:00.000Z", "startedAt": "2026-11-08T12:00:00.000Z", "endedAt": "2026-11-08T12:00:00.000Z" }, "apps": [ { "appId": "5a6b7c8d-9e0f-4a1b-8c2d-3e4f5a6b7c8d", "slug": "facebook-capi", "name": "Facebook CAPI", "iconHash": null, "version": "1.4.1", "necessary": false, "legal": { "termsUrl": "https://example.com/legal/terms", "privacyUrl": "https://example.com/legal/privacy" }, "installedOn": [ "3f2a9c81-5d47-4e0b-8c66-91b2a7f04d15" ] } ]}invalid_params — A path parameter failed validation (for example a malformed UUID); details pinpoints the offending parameter.
object
Machine-readable error slug; switch on this value rather than on the HTTP status alone.
Field-level validation errors: a tree keyed by input property, each node carrying an errors array of human-readable messages. Render it to help the caller correct the request.
object
Example
{ "error": "invalid_params", "details": { "errors": [], "properties": { "teamId": { "errors": [ "Invalid UUID" ] } } }}unauthenticated — The Authorization: Bearer token is missing, malformed, or no longer valid. Generate a team API token or obtain a new OAuth access token.
object
Machine-readable error slug; switch on this value rather than on the HTTP status alone.
Example
{ "error": "unauthenticated"}forbidden — The bearer credential lacks the required permission or belongs to another team, or its user lacks the organization role a developer operation needs. Update its policies, use a credential bound to the addressed team, or ask an organization owner for the role; message states the reason when one is known.
object
Machine-readable error slug; switch on this value rather than on the HTTP status alone.
Human-readable reason for this specific failure, intended for display — do not parse it programmatically.
Example
{ "error": "forbidden", "message": "The Cloudflare API token is invalid or expired."}not_found — The addressed resource does not exist within this team; check the id and retry.
object
Machine-readable error slug; switch on this value rather than on the HTTP status alone.
Example
{ "error": "not_found"}internal — Unexpected server error. Nothing is guaranteed to have been persisted; idempotent operations are safe to retry.
object
Machine-readable error slug; switch on this value rather than on the HTTP status alone.
Example
{ "error": "internal"}