List the tenant's app registrations

GET

/v1/connection-apps

curl --request GET \
  --url 'https://example.com/v1/connection-apps?includeRemoved=false&limit=25' \
  --header 'Authorization: Bearer <token>'

• Same-origin — path relative to the deployment root.

The tenant’s own registrations of its client at an app: its client id, and its secrets by reference. Tenant admins only. Removed registrations are listed only with includeRemoved=true.

Authorizations

• bearerAuth

Parameters

Query Parameters

includeRemoved

boolean

true lists removed registrations too.

limit

integer

default: 25 >= 1 <= 100

1..100. Default 25.

cursor

string

Where the previous page ended: its nextCursor, as it came. A runtime that seals cursors takes one only for the same list, filters and caller, within a day; otherwise 400 bad-input, and the list starts again without it. Absent → first page.

Responses

200

Page of registrations.

Media typeapplication/json

object

data

required

Array<object>

A tenant’s registration of its own client at an app. Secrets are references, never values.

object

appId

required

string format: uuid

app

required

The app’s entry id.

string

label

string

oauth2

object

clientId

required

string

clientSecret

required

A secret by name in the deployment’s secrets store, resolved at tenant scope. The registration keeps only this reference, never the value.

object

envName

required

string

/^[a-z][a-z0-9-]{0,62}$/

name

required

string

>= 1 characters <= 256 characters

tenant

The directory the app signs people in at, for an app whose sign-in names one: Microsoft’s tenant id or domain for a single-tenant app, organizations, common or consumers for a multi-tenant one. Required when the app’s entry has no default, refused for an app without one (connection-app-invalid, details.field oauth2.tenant).

string

>= 1 characters <= 253 characters

githubApp

object

appNumber

required

integer

>= 1

slug

required

The app’s slug.

string

clientId

required

string

clientSecret

required

A secret by name in the deployment’s secrets store, resolved at tenant scope. The registration keeps only this reference, never the value.

object

envName

required

string

/^[a-z][a-z0-9-]{0,62}$/

name

required

string

>= 1 characters <= 256 characters

privateKey

required

A secret by name in the deployment’s secrets store, resolved at tenant scope. The registration keeps only this reference, never the value.

object

envName

required

string

/^[a-z][a-z0-9-]{0,62}$/

name

required

string

>= 1 characters <= 256 characters

webhookSecret

required

A secret by name in the deployment’s secrets store, resolved at tenant scope. The registration keeps only this reference, never the value.

object

envName

required

string

/^[a-z][a-z0-9-]{0,62}$/

name

required

string

>= 1 characters <= 256 characters

projects

The projects whose runs may use its connections. Absent: every project.

Array<string>

redirectUrl

required

Give this to the app as its redirect URL: a GitHub App’s Callback URL, with “Request user authorization (OAuth) during installation” ticked.

string format: uri

noticesUrl

required

Give this to the app as the place it reports removals.

string format: uri

createdAt

required

string format: date-time

updatedAt

required

string format: date-time

removedAt

string format: date-time

nextCursor

string

hasMore

required

boolean

Example^generated

{
  "data": [
    {
      "appId": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0",
      "app": "example",
      "label": "example",
      "oauth2": {
        "clientId": "example",
        "clientSecret": {
          "envName": "example",
          "name": "example"
        },
        "tenant": "example"
      },
      "githubApp": {
        "appNumber": 1,
        "slug": "example",
        "clientId": "example",
        "clientSecret": {
          "envName": "example",
          "name": "example"
        },
        "privateKey": {
          "envName": "example",
          "name": "example"
        },
        "webhookSecret": {
          "envName": "example",
          "name": "example"
        }
      },
      "projects": [
        "example"
      ],
      "redirectUrl": "https://example.com",
      "noticesUrl": "https://example.com",
      "createdAt": "2026-04-15T12:00:00Z",
      "updatedAt": "2026-04-15T12:00:00Z",
      "removedAt": "2026-04-15T12:00:00Z"
    }
  ],
  "nextCursor": "example",
  "hasMore": true
}

400

An includeRemoved other than true or false (bad-input).

Media typeapplication/json

object

error

required

object

code

required

Stable machine-readable discriminant. Values match domain error codes (see docs/API-ROUTE-CONVENTIONS.md §4.3).

string

message

required

string

details

Optional, kind-specific.

object

key

additional properties

any

requestId

required

Server-assigned request id; also echoed via X-Request-Id header.

string

Example^generated

{
  "error": {
    "code": "example",
    "message": "example",
    "details": {},
    "requestId": "example"
  }
}

401

Missing / malformed / expired / revoked bearer token.

Media typeapplication/json

object

error

required

object

code

required

Stable machine-readable discriminant. Values match domain error codes (see docs/API-ROUTE-CONVENTIONS.md §4.3).

string

message

required

string

details

Optional, kind-specific.

object

key

additional properties

any

requestId

required

Server-assigned request id; also echoed via X-Request-Id header.

string

Example^generated

{
  "error": {
    "code": "example",
    "message": "example",
    "details": {},
    "requestId": "example"
  }
}

403

Not a tenant admin (permission-denied).

Media typeapplication/json

object

error

required

object

code

required

Stable machine-readable discriminant. Values match domain error codes (see docs/API-ROUTE-CONVENTIONS.md §4.3).

string

message

required

string

details

Optional, kind-specific.

object

key

additional properties

any

requestId

required

Server-assigned request id; also echoed via X-Request-Id header.

string

Example^generated

{
  "error": {
    "code": "example",
    "message": "example",
    "details": {},
    "requestId": "example"
  }
}

503

The database was too busy to answer in time (database-busy); Retry-After (whole seconds) says when to try again.

Media typeapplication/json

object

error

required

object

code

required

Stable machine-readable discriminant. Values match domain error codes (see docs/API-ROUTE-CONVENTIONS.md §4.3).

string

message

required

string

details

Optional, kind-specific.

object

key

additional properties

any

requestId

required

Server-assigned request id; also echoed via X-Request-Id header.

string

Example^generated

{
  "error": {
    "code": "example",
    "message": "example",
    "details": {},
    "requestId": "example"
  }
}

See also

• POST /v1/connection-apps: Register an app
• Error code bad-input
• Error code database-busy
• Error code permission-denied
• Every error code