List installable apps
const url = 'https://qinto-api.blotout.io/me/installable-apps?limit=50&cursor=facebook-capi';const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
try { const response = await fetch(url, options); const data = await response.json(); console.log(data);} catch (error) { console.error(error);}curl --request GET \ --url 'https://qinto-api.blotout.io/me/installable-apps?limit=50&cursor=facebook-capi' \ --header 'Authorization: Bearer <token>'Lists the apps the caller may install on a site: every published app of each developer organization they belong to, with its latest version. Call it to find the appSlug an install takes.
How it works
Apps with no published version are left out. Page with cursor from the previous response’s nextCursor; a null cursor means the last page. Installing still needs app management on the target site.
Required permissions
- None beyond a valid token; requires an OAuth token with the
profilescope, and installing a listed app additionally needsdomain:manage_domain_apps:writeon the target site
Authorizations
Section titled “Authorizations”Parameters
Section titled “Parameters”Query Parameters
Section titled “Query Parameters”How many apps to return, 1–200.
Example
50How many apps to return, 1–200.
Continue after this app slug, from a previous response’s nextCursor.
Example
facebook-capiContinue after this app slug, from a previous response’s nextCursor.
Responses
Section titled “Responses”The page of apps.
object
The page of apps, A–Z by slug.
An app the caller may install on a site they manage apps on.
object
The app’s slug, to pass as appSlug when installing.
The app’s display name.
What the app does, or null when the developer gave no description.
The developer organization that owns the app.
That organization’s display name.
The highest published version, which an install takes by default.
The visitor consent the app runs under; a necessary app needs an acknowledgement before its first install.
Whether one site can install the app more than once.
The settings each install takes, as the latest version declares them.
One setting a site manager fills in for each install of an app.
object
The name to send the value under when configuring an install.
A plain value is readable back; a secret one is write-only and never returned.
The value it takes: a string for text and password, a boolean for toggle, for select the value of one of options or an empty string for none, and for multiselect a list of options values, empty for none.
Display label the manifest gives the variable.
Whether an install stays inactive until it has a value.
One-line guidance the manifest supplies, or null when it supplies none.
Link to the vendor’s own documentation for this value, or null when the manifest supplies none.
The choices of a select or multiselect, in manifest order, or null for every other type.
One choice of a select or multiselect variable.
object
The value to send and the value stored when this option is picked.
The text a form shows for this option.
Whether a form pre-selects this option while the install has no value. The platform never stores a default on its own.
Pass as cursor for the next page, or null on the last one.
Example
{ "records": [ { "slug": "facebook-capi", "name": "Facebook CAPI", "description": "Sends events to Meta.", "organizationId": "5e8c2d90-4b17-4f3a-9d21-8a63f0b7c154", "organizationName": "Acme Dev", "latestVersion": "1.4.1", "consentCategory": "marketing", "multipleInstalls": false, "variables": [ { "name": "PIXEL_ID", "kind": "plain", "type": "text", "label": "Pixel id", "required": true, "helpText": "Found under Data sources in Meta Events Manager.", "helpUrl": "https://developers.example.com/pixel-id", "options": null } ] } ], "nextCursor": "facebook-capi"}invalid_body — The JSON body is unparseable or failed schema validation; details pinpoints the offending fields when the body could be parsed.
object
Machine-readable error slug; switch on this value rather than on the HTTP status alone.
Field-level validation errors: a tree keyed by input property, each node carrying an errors array of human-readable messages. Render it to help the caller correct the request.
object
Example
{ "error": "invalid_body", "details": { "errors": [], "properties": { "teamId": { "errors": [ "Invalid UUID" ] } } }}unauthenticated — The Authorization: Bearer token is missing, malformed, or no longer valid. Generate a team API token or obtain a new OAuth access token.
object
Machine-readable error slug; switch on this value rather than on the HTTP status alone.
Example
{ "error": "unauthenticated"}forbidden — The bearer credential lacks the required permission or belongs to another team, or its user lacks the organization role a developer operation needs. Update its policies, use a credential bound to the addressed team, or ask an organization owner for the role; message states the reason when one is known.
object
Machine-readable error slug; switch on this value rather than on the HTTP status alone.
Human-readable reason for this specific failure, intended for display — do not parse it programmatically.
Example
{ "error": "forbidden", "message": "The Cloudflare API token is invalid or expired."}internal — Unexpected server error. Nothing is guaranteed to have been persisted; idempotent operations are safe to retry.
object
Machine-readable error slug; switch on this value rather than on the HTTP status alone.
Example
{ "error": "internal"}