List a site’s included apps
const url = 'https://qinto-api.blotout.io/teams/7b8d1a52-6c1e-4b6f-9a30-2f8a54d1c3e9/domains/3f2a9c81-5d47-4e0b-8c66-91b2a7f04d15/included-apps?cursorName=Facebook%20CAPI&cursorId=5a6b7c8d-9e0f-4a1b-8c2d-3e4f5a6b7c8d&limit=50';const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
try { const response = await fetch(url, options); const data = await response.json(); console.log(data);} catch (error) { console.error(error);}curl --request GET \ --url 'https://qinto-api.blotout.io/teams/7b8d1a52-6c1e-4b6f-9a30-2f8a54d1c3e9/domains/3f2a9c81-5d47-4e0b-8c66-91b2a7f04d15/included-apps?cursorName=Facebook%20CAPI&cursorId=5a6b7c8d-9e0f-4a1b-8c2d-3e4f5a6b7c8d&limit=50' \ --header 'Authorization: Bearer <token>'Lists one page of the apps a bundle the team bought covers on the site that the site does not run yet. Install one with the install operation at no charge beyond the bundle: it needs no charge approval.
How it works
Each app comes with the purchase that covers it, the version an install takes and that version’s consent category and legal links. An app that joined the bundle after the purchase is listed like any other; one the site runs, or one that was deleted, is not. Only a token with a user lists; a team API token is refused.
Required permissions
domain:readon all domains, or on the addressed domain when its id is in the route
Authorizations
Section titled “Authorizations”Parameters
Section titled “Parameters”Path Parameters
Section titled “Path Parameters”Unique id (UUID) of the team that owns the addressed resources, as shown in the team settings on the Blotout platform.
Example
7b8d1a52-6c1e-4b6f-9a30-2f8a54d1c3e9Unique id (UUID) of the team that owns the addressed resources, as shown in the team settings on the Blotout platform.
Unique id (UUID) of the site, as returned by the site operations.
Example
3f2a9c81-5d47-4e0b-8c66-91b2a7f04d15Unique id (UUID) of the site, as returned by the site operations.
Query Parameters
Section titled “Query Parameters”The nextCursor.name of the previous page.
Example
Facebook CAPIThe nextCursor.name of the previous page.
The nextCursor.id of the previous page.
Example
5a6b7c8d-9e0f-4a1b-8c2d-3e4f5a6b7c8dThe nextCursor.id of the previous page.
Page size, 1–200 (default 50).
Example
50Page size, 1–200 (default 50).
Responses
Section titled “Responses”The included apps.
object
One page of the site’s included apps, A–Z by name.
An app a bundle purchase covers on the site that the site does not run yet.
object
Id of the app.
Slug of the app, to pass to the install operation.
Display name of the app.
Content hash of the app’s icon; null when it has none.
The developer organization’s name.
The team’s purchase that covers the app on this site.
The name of the bundle the purchase holds.
The version an install takes: the newest the site may run.
The consent category that version declares; necessary needs acknowledgeNecessary to install.
The developer’s legal documents, accepted when the bundle was bought.
object
The developer’s terms for the app.
The developer’s privacy policy for the app.
Pass it as cursorName and cursorId for the next page; null on the last page.
object
Name of the last listed app.
Id of the last listed app.
Example
{ "apps": [ { "appId": "5a6b7c8d-9e0f-4a1b-8c2d-3e4f5a6b7c8d", "slug": "facebook-capi", "name": "Facebook CAPI", "iconHash": null, "publisher": "Acme Dev", "bundlePurchaseId": "9c1d2e3f-4a5b-4c6d-8e7f-0a1b2c3d4e5f", "bundleName": "Growth Stack", "version": "1.4.1", "consentCategory": "necessary", "legal": { "termsUrl": "https://example.com/legal/terms", "privacyUrl": "https://example.com/legal/privacy" } } ], "nextCursor": { "name": "Facebook CAPI", "id": "5a6b7c8d-9e0f-4a1b-8c2d-3e4f5a6b7c8d" }}invalid_params — A path parameter failed validation (for example a malformed UUID); details pinpoints the offending parameter.
object
Machine-readable error slug; switch on this value rather than on the HTTP status alone.
Field-level validation errors: a tree keyed by input property, each node carrying an errors array of human-readable messages. Render it to help the caller correct the request.
object
Example
{ "error": "invalid_params", "details": { "errors": [], "properties": { "teamId": { "errors": [ "Invalid UUID" ] } } }}unauthenticated — The Authorization: Bearer token is missing, malformed, or no longer valid. Generate a team API token or obtain a new OAuth access token.
object
Machine-readable error slug; switch on this value rather than on the HTTP status alone.
Example
{ "error": "unauthenticated"}forbidden — The bearer credential lacks the required permission or belongs to another team, or its user lacks the organization role a developer operation needs. Update its policies, use a credential bound to the addressed team, or ask an organization owner for the role; message states the reason when one is known.
object
Machine-readable error slug; switch on this value rather than on the HTTP status alone.
Human-readable reason for this specific failure, intended for display — do not parse it programmatically.
Example
{ "error": "forbidden", "message": "The Cloudflare API token is invalid or expired."}internal — Unexpected server error. Nothing is guaranteed to have been persisted; idempotent operations are safe to retry.
object
Machine-readable error slug; switch on this value rather than on the HTTP status alone.
Example
{ "error": "internal"}