List reachable app tools

GET

/me/app-tools

const url = 'https://qinto-api.blotout.io/me/app-tools';
const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request GET \
  --url https://qinto-api.blotout.io/me/app-tools \
  --header 'Authorization: Bearer <token>'

Lists every tool the caller can run, contributed by the apps installed on the sites they may read — one entry per app tool, whichever sites it reaches. Apps the caller has no access to, and tools above their app role on a site, are left out.

How it works

A tool is listed only when every site the caller can run it on agrees on the arguments it takes, so one advertised schema is always the right one. Anything else left out appears in warnings with the sites and versions involved. Requires an OAuth access token.

Required permissions

None beyond a valid token; each tool additionally needs read access to the site it is listed for

Authorizations

QintoAccessToken

Responses

200

The reachable tools.

application/json

object

tools

required

The reachable tools, ordered by app slug then tool name.

Array<object>

One app tool the caller can reach, deduplicated across their sites.

object

mcpName

required

The tool’s name in the shared assistant namespace.

string

appSlug

required

The app that contributes the tool.

string

appName

required

That app’s display name.

string

name

required

The tool’s own name, without the app prefix.

string

title

required

A short name to show a reader.

string

description

required

What the tool does, written by the app’s developer.

string

annotations

required

The tool’s advertised behaviour, merged conservatively across the versions in play.

object

readOnlyHint

required

True only when every reachable version is read-only.

boolean

destructiveHint

required

True as soon as any reachable version says so.

boolean

idempotentHint

required

True only when every reachable version says so.

boolean

inputSchema

required

The JSON Schema of everything the call takes, including teamId, siteId and installId.

object

key

additional properties

sites

required

The sites this tool can be run against.

Array<object>

A site the caller may run this tool against.

object

teamId

required

The team that owns the site.

string

domainId

required

The site to pass as siteId.

string

domain

required

The site’s hostname, for showing a reader which site this is.

string

warnings

required

Tools deliberately left out of tools, so a staggered rollout is never silent.

Array<object>

A tool that exists but is not advertised, and why.

object

appSlug

required

The app whose tool is withheld.

string

toolName

required

The tool that is not listed.

string

reason

required

Why it is withheld: the reachable versions describe different arguments, one of them does not declare it, or it is switched off everywhere.

string

Allowed values: schema_divergence absent_in_version disabled_on_site

sites

required

The sites and versions involved.

Array

A site the caller may run this tool against.

object

teamId

required

The team that owns the site.

string

domainId

required

The site to pass as siteId.

string

domain

required

The site’s hostname, for showing a reader which site this is.

string

version

required

The version that site serves.

string

Example

{
  "tools": [
    {
      "mcpName": "facebook-capi_emqReport",
      "appSlug": "facebook-capi",
      "appName": "Facebook CAPI",
      "name": "emqReport",
      "title": "Event match quality report",
      "description": "Reads this install and reports its event match quality score.",
      "annotations": {
        "readOnlyHint": true,
        "destructiveHint": false,
        "idempotentHint": true
      },
      "inputSchema": {
        "type": "object",
        "properties": {},
        "required": [
          "teamId",
          "siteId"
        ]
      },
      "sites": [
        {
          "teamId": "7b8d1a52-6c1e-4b6f-9a30-2f8a54d1c3e9",
          "domainId": "3f2a9c81-5d47-4e0b-8c66-91b2a7f04d15",
          "domain": "q.shop.example.com"
        }
      ]
    }
  ],
  "warnings": [
    {
      "appSlug": "facebook-capi",
      "toolName": "emqReport",
      "reason": "schema_divergence",
      "sites": [
        {
          "teamId": "7b8d1a52-6c1e-4b6f-9a30-2f8a54d1c3e9",
          "domainId": "3f2a9c81-5d47-4e0b-8c66-91b2a7f04d15",
          "domain": "q.shop.example.com",
          "version": "1.4.1"
        }
      ]
    }
  ]
}

401

unauthenticated — The Authorization: Bearer token is missing, malformed, or no longer valid. Generate a team API token or obtain a new OAuth access token.

application/json

object

error

required

Machine-readable error slug; switch on this value rather than on the HTTP status alone.

string

Allowed values: unauthenticated

Example

{
  "error": "unauthenticated"
}

403

forbidden — The bearer credential lacks the required permission or belongs to another team, or its user lacks the organization role a developer operation needs. Update its policies, use a credential bound to the addressed team, or ask an organization owner for the role; message states the reason when one is known.

application/json

object

error

required

Machine-readable error slug; switch on this value rather than on the HTTP status alone.

string

Allowed values: forbidden

message

Human-readable reason for this specific failure, intended for display — do not parse it programmatically.

string

Example

{
  "error": "forbidden",
  "message": "The Cloudflare API token is invalid or expired."
}

500

internal — Unexpected server error. Nothing is guaranteed to have been persisted; idempotent operations are safe to retry.

application/json

object

error

required

Machine-readable error slug; switch on this value rather than on the HTTP status alone.

string

Allowed values: internal

Example

{
  "error": "internal"
}