# List the tenant's app registrations

GET

/v1/connection-apps

```sh
curl --request GET \
  --url 'https://example.com/v1/connection-apps?includeRemoved=false&limit=25' \
  --header 'Authorization: Bearer <token>'
```

The tenant’s own registrations of its client at an app: its client id, and its secrets by reference. Tenant admins only. Removed registrations are listed only with `includeRemoved=true`.

## Authorizations

- **[bearerAuth](https://docs.kindgi.com/v0.4.0/reference/api.md#bearerauth)**

## Parameters

### Query Parameters

**includeRemoved**

boolean

`true` lists removed registrations too.

**limit**

integer

default: 25 >= 1 <= 100

1..100. Default 25.

**cursor**

string

Where the previous page ended: its `nextCursor`, as it came. A runtime that seals cursors takes one only for the same list, filters and caller, within a day; otherwise `400 bad-input`, and the list starts again without it. Absent → first page.

## Responses

### 200

Page of registrations.

application/json

object

**data**

required

Array\<object>

A tenant’s registration of its own client at an app. Secrets are references, never values.

object

**appId**

required

string format: uuid

**app**

required

The app’s entry id.

string

**label**

string

**oauth2**

object

**clientId**

required

string

**clientSecret**

required

A secret by name in the deployment’s secrets store, resolved at tenant scope. The registration keeps only this reference, never the value.

object

**envName**

required

string

/^\[a-z]\[a-z0-9-]{0,62}$/

**name**

required

string

\>= 1 characters <= 256 characters

**tenant**

The directory the app signs people in at, for an app whose sign-in names one: Microsoft’s tenant id or domain for a single-tenant app, `organizations`, `common` or `consumers` for a multi-tenant one. Required when the app’s entry has no default, refused for an app without one (`connection-app-invalid`, `details.field` `oauth2.tenant`).

string

\>= 1 characters <= 253 characters

**githubApp**

object

**appNumber**

required

integer

\>= 1

**slug**

required

The app’s slug.

string

**clientId**

required

string

**clientSecret**

required

A secret by name in the deployment’s secrets store, resolved at tenant scope. The registration keeps only this reference, never the value.

object

**envName**

required

string

/^\[a-z]\[a-z0-9-]{0,62}$/

**name**

required

string

\>= 1 characters <= 256 characters

**privateKey**

required

A secret by name in the deployment’s secrets store, resolved at tenant scope. The registration keeps only this reference, never the value.

object

**envName**

required

string

/^\[a-z]\[a-z0-9-]{0,62}$/

**name**

required

string

\>= 1 characters <= 256 characters

**webhookSecret**

required

A secret by name in the deployment’s secrets store, resolved at tenant scope. The registration keeps only this reference, never the value.

object

**envName**

required

string

/^\[a-z]\[a-z0-9-]{0,62}$/

**name**

required

string

\>= 1 characters <= 256 characters

**projects**

The projects whose runs may use its connections. Absent: every project.

Array\<string>

**redirectUrl**

required

Give this to the app as its redirect URL: a GitHub App’s Callback URL, with “Request user authorization (OAuth) during installation” ticked.

string format: uri

**noticesUrl**

required

Give this to the app as the place it reports removals.

string format: uri

**createdAt**

required

string format: date-time

**updatedAt**

required

string format: date-time

**removedAt**

string format: date-time

**nextCursor**

string

**hasMore**

required

boolean

##### Examplegenerated

```json
{
  "data": [
    {
      "appId": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0",
      "app": "example",
      "label": "example",
      "oauth2": {
        "clientId": "example",
        "clientSecret": {
          "envName": "example",
          "name": "example"
        },
        "tenant": "example"
      },
      "githubApp": {
        "appNumber": 1,
        "slug": "example",
        "clientId": "example",
        "clientSecret": {
          "envName": "example",
          "name": "example"
        },
        "privateKey": {
          "envName": "example",
          "name": "example"
        },
        "webhookSecret": {
          "envName": "example",
          "name": "example"
        }
      },
      "projects": [
        "example"
      ],
      "redirectUrl": "https://example.com",
      "noticesUrl": "https://example.com",
      "createdAt": "2026-04-15T12:00:00Z",
      "updatedAt": "2026-04-15T12:00:00Z",
      "removedAt": "2026-04-15T12:00:00Z"
    }
  ],
  "nextCursor": "example",
  "hasMore": true
}
```

### 400

An `includeRemoved` other than `true` or `false` (`bad-input`).

application/json

object

**error**

required

object

**code**

required

Stable machine-readable discriminant. Values match domain error codes (see `docs/API-ROUTE-CONVENTIONS.md` §4.3).

string

**message**

required

string

**details**

Optional, kind-specific.

object

**_key_**

additional properties

any

**requestId**

required

Server-assigned request id; also echoed via `X-Request-Id` header.

string

##### Examplegenerated

```json
{
  "error": {
    "code": "example",
    "message": "example",
    "details": {},
    "requestId": "example"
  }
}
```

### 401

Missing / malformed / expired / revoked bearer token.

application/json

object

**error**

required

object

**code**

required

Stable machine-readable discriminant. Values match domain error codes (see `docs/API-ROUTE-CONVENTIONS.md` §4.3).

string

**message**

required

string

**details**

Optional, kind-specific.

object

**_key_**

additional properties

any

**requestId**

required

Server-assigned request id; also echoed via `X-Request-Id` header.

string

##### Examplegenerated

```json
{
  "error": {
    "code": "example",
    "message": "example",
    "details": {},
    "requestId": "example"
  }
}
```

### 403

Not a tenant admin (`permission-denied`).

application/json

object

**error**

required

object

**code**

required

Stable machine-readable discriminant. Values match domain error codes (see `docs/API-ROUTE-CONVENTIONS.md` §4.3).

string

**message**

required

string

**details**

Optional, kind-specific.

object

**_key_**

additional properties

any

**requestId**

required

Server-assigned request id; also echoed via `X-Request-Id` header.

string

##### Examplegenerated

```json
{
  "error": {
    "code": "example",
    "message": "example",
    "details": {},
    "requestId": "example"
  }
}
```

### 503

The database was too busy to answer in time (`database-busy`); `Retry-After` (whole seconds) says when to try again.

application/json

object

**error**

required

object

**code**

required

Stable machine-readable discriminant. Values match domain error codes (see `docs/API-ROUTE-CONVENTIONS.md` §4.3).

string

**message**

required

string

**details**

Optional, kind-specific.

object

**_key_**

additional properties

any

**requestId**

required

Server-assigned request id; also echoed via `X-Request-Id` header.

string

##### Examplegenerated

```json
{
  "error": {
    "code": "example",
    "message": "example",
    "details": {},
    "requestId": "example"
  }
}
```

## See also

- [`POST /v1/connection-apps`: Register an app](https://docs.kindgi.com/v0.4.0/reference/api/operations/connectionappscreate.md)
- [Error code `bad-input`](https://docs.kindgi.com/v0.4.0/reference/errors.md#bad-input)
- [Error code `database-busy`](https://docs.kindgi.com/v0.4.0/reference/errors.md#database-busy)
- [Error code `permission-denied`](https://docs.kindgi.com/v0.4.0/reference/errors.md#permission-denied)
- [Every error code](https://docs.kindgi.com/v0.4.0/reference/errors.md)