> ## Documentation Index
> Fetch the complete documentation index at: https://docs.base44.com/llms.txt
> Use this file to discover all available pages before exploring further.
# List apps
> This API is in beta. Endpoints, fields, and behavior may still change, so avoid depending on it in production.
Retrieves a list of apps in a [workspace](/documentation/account-and-billing/about-workspaces), including deleted and blocked apps. Their resources, such as [secrets](/Enterprise/workspace-secrets), can still exist.
Use this method to view, for each app:
- Who owns and created it.
- Whether it's published and who can open it.
- How people [sign in](/Setting-up-your-app/Managing-login-and-registration) to it.
- Security settings, such as [embedding rules](/Enterprise/Enterprise-SSO-and-app-visibility#controlling-app-embedding) and browser feature restrictions.
- Whether it has [secrets](/Enterprise/workspace-secrets), [backend functions](/developers/backend/resources/backend-functions/overview), or an active [agent](/Building-your-app/AI-agents-for-apps).
- Where its data is stored, such as its region or the workspace's own MongoDB database.
- The [GitHub repository](/Integrations/github-connector) connected to it.
To call this method, your API key must include the `compliance:inventory:read` [scope](/developers/references/compliance-api/get-started/authentication#scopes).
## OpenAPI
````yaml /developers/references/compliance-api/compliance-openapi.json get /{workspace_id}/apps
openapi: 3.1.0
info:
title: Base44 Compliance API
description: >
Read-only API for security partners to review the security configuration of
a Base44 workspace.
The API reports what exists in a workspace and how it's configured. It
doesn't report activity. To review activity, use the Audit Logs API.
The Compliance API is available for Enterprise workspaces only. To get
started, see the
[overview](/developers/references/compliance-api/get-started/overview).
version: 1.0.0
servers:
- url: https://app.base44.com/api/v1/compliance
description: Compliance API
security:
- ApiKeyAuth: []
PartnerTokenAuth: []
tags:
- name: compliance
description: Read workspace configuration, inventory, and security posture.
paths:
/{workspace_id}/apps:
get:
tags:
- compliance
summary: List apps
description: >-
This API is in beta. Endpoints, fields, and behavior may still
change, so avoid depending on it in production.
Retrieves a list of apps in a
[workspace](/documentation/account-and-billing/about-workspaces),
including deleted and blocked apps. Their resources, such as
[secrets](/Enterprise/workspace-secrets), can still exist.
Use this method to view, for each app:
- Who owns and created it.
- Whether it's published and who can open it.
- How people [sign
in](/Setting-up-your-app/Managing-login-and-registration) to it.
- Security settings, such as [embedding
rules](/Enterprise/Enterprise-SSO-and-app-visibility#controlling-app-embedding)
and browser feature restrictions.
- Whether it has [secrets](/Enterprise/workspace-secrets), [backend
functions](/developers/backend/resources/backend-functions/overview), or
an active [agent](/Building-your-app/AI-agents-for-apps).
- Where its data is stored, such as its region or the workspace's own
MongoDB database.
- The [GitHub repository](/Integrations/github-connector) connected to
it.
To call this method, your API key must include the
`compliance:inventory:read`
[scope](/developers/references/compliance-api/get-started/authentication#scopes).
operationId: list_apps__workspace_id__apps_get
parameters:
- name: workspace_id
in: path
required: true
schema:
type: string
description: >-
Workspace ID. Learn more about how to [retrieve your workspace
ID](/developers/references/compliance-api/get-started/authentication#workspace-id).
title: Workspace Id
description: >-
Workspace ID. Learn more about how to [retrieve your workspace
ID](/developers/references/compliance-api/get-started/authentication#workspace-id).
example: 67f2c8e01a3b5d004e92d7a1
- name: cursor
in: query
required: false
schema:
anyOf:
- type: string
- type: 'null'
description: >-
Cursor for the next page. Pass the `next_cursor` value from the
previous response back unchanged. Don't send `limit` with it,
because the cursor already carries the limit. Cursors are valid
for 24 hours, and a cursor from a different workspace isn't valid.
Sending `limit` with a cursor, or an invalid cursor, returns a
`400` error.
title: Cursor
description: >-
Cursor for the next page. Pass the `next_cursor` value from the
previous response back unchanged. Don't send `limit` with it,
because the cursor already carries the limit. Cursors are valid for
24 hours, and a cursor from a different workspace isn't valid.
Sending `limit` with a cursor, or an invalid cursor, returns a `400`
error.
example: gAAAAABn7vJ...
- name: limit
in: query
required: false
schema:
anyOf:
- type: integer
maximum: 1000
minimum: 1
- type: 'null'
description: >-
Number of items per page. The maximum is 1000. Don't send it with
`cursor`, because the cursor already carries the limit.
Default: 100.
title: Limit
description: >-
Number of items per page. The maximum is 1000. Don't send it with
`cursor`, because the cursor already carries the limit.
Default: 100.
example: 100
responses:
'200':
description: Successful Response
content:
application/json:
schema:
$ref: '#/components/schemas/CompliancePage_ComplianceApp_'
'400':
description: >-
The request is invalid, for example a parameter is malformed or the
`cursor` is invalid or expired. The error `type` is
`invalid_request_error`. See [error
codes](/developers/references/compliance-api/get-started/error-codes).
content:
application/json:
examples:
invalid_request_error:
summary: invalid_request_error
value:
error:
type: invalid_request_error
message: The request is invalid.
schema:
$ref: '#/components/schemas/ComplianceErrorResponse'
'401':
description: >-
A credential failed. The workspace API key is missing, unknown, or
disabled, or your signed token is missing or Base44 can't verify it
(`partner_key_required`). Check the `code` to see which credential
to fix. Don't ask the workspace admin to create a new key for
`partner_key_required`. The error `type` is `authentication_error`.
See [error
codes](/developers/references/compliance-api/get-started/error-codes).
content:
application/json:
examples:
authentication_error:
summary: authentication_error
value:
error:
type: authentication_error
message: Invalid workspace API key.
partner_key_required:
summary: partner_key_required
value:
error:
type: authentication_error
message: >-
Missing or invalid compliance partner assertion in the
Authorization header. The workspace API key is sent
separately and is not the credential at fault here.
code: partner_key_required
schema:
$ref: '#/components/schemas/ComplianceErrorResponse'
'402':
description: >-
The workspace's plan doesn't include the Compliance API, or its
subscription has lapsed (`plan_not_included`). The error `type` is
`permission_error`. See [error
codes](/developers/references/compliance-api/get-started/error-codes).
content:
application/json:
examples:
plan_not_included:
summary: plan_not_included
value:
error:
type: permission_error
message: This API key is not permitted to perform that request.
code: plan_not_included
schema:
$ref: '#/components/schemas/ComplianceErrorResponse'
'403':
description: >-
The key doesn't have the scope the method needs (`missing_scope`),
the key belongs to a different workspace (`workspace_mismatch`), the
Compliance API isn't enabled for the workspace
(`feature_not_enabled`), or Base44 suspended your partner
registration (`partner_not_approved`). The error `type` is
`permission_error`. See [error
codes](/developers/references/compliance-api/get-started/error-codes).
content:
application/json:
examples:
missing_scope:
summary: missing_scope
value:
error:
type: permission_error
message: >-
This API key is not permitted to perform that request.
Needed: [compliance:members:read]
code: missing_scope
required_scope: compliance:members:read
workspace_mismatch:
summary: workspace_mismatch
value:
error:
type: permission_error
message: API key does not belong to this workspace
code: workspace_mismatch
feature_not_enabled:
summary: feature_not_enabled
value:
error:
type: permission_error
message: The Compliance API is not enabled for this workspace.
code: feature_not_enabled
partner_not_approved:
summary: partner_not_approved
value:
error:
type: permission_error
message: >-
This compliance partner is not approved to call the
Compliance API. Contact Base44; the customer cannot
grant this.
code: partner_not_approved
schema:
$ref: '#/components/schemas/ComplianceErrorResponse'
'404':
description: >-
The workspace doesn't exist. The error `type` is `not_found_error`.
See [error
codes](/developers/references/compliance-api/get-started/error-codes).
content:
application/json:
examples:
not_found_error:
summary: not_found_error
value:
error:
type: not_found_error
message: Not found.
schema:
$ref: '#/components/schemas/ComplianceErrorResponse'
'429':
description: >-
The workspace sent too many requests. Wait the number of seconds in
the `retry-after` header, then retry with a newly signed
authentication token. The error `type` is `rate_limit_error`. See
[rate
limits](/developers/references/compliance-api/get-started/rate-limits).
content:
application/json:
examples:
rate_limit_error:
summary: rate_limit_error
value:
error:
type: rate_limit_error
message: >-
Rate limit exceeded. Retry after the interval in the
retry-after header.
schema:
$ref: '#/components/schemas/ComplianceErrorResponse'
'500':
description: >-
Something went wrong on Base44's side. Retry with exponential
backoff and a newly signed authentication token. If the code is
`inventory_too_large`, the workspace has more items than the API can
return, and retrying doesn't help. Ask your Base44 partner contact
for help. See [error
codes](/developers/references/compliance-api/get-started/error-codes).
content:
application/json:
examples:
api_error:
summary: api_error
value:
error:
type: api_error
message: >-
An internal error occurred. Retry with exponential
backoff.
inventory_too_large:
summary: inventory_too_large
value:
error:
type: api_error
message: >-
This workspace holds more rows than a single compliance
read supports (9999). Returning a partial inventory
would misreport it, so the request failed instead. Not
retryable without a change on our side.
code: inventory_too_large
schema:
$ref: '#/components/schemas/ComplianceErrorResponse'
components:
schemas:
CompliancePage_ComplianceApp_:
properties:
data:
items:
$ref: '#/components/schemas/ComplianceApp'
type: array
title: Data
description: Items on this page.
pagination:
$ref: '#/components/schemas/PublicPaginationInfo'
description: Pagination details for this page.
type: object
required:
- data
- pagination
title: CompliancePage[ComplianceApp]
description: One page of results from a list endpoint.
ComplianceErrorResponse:
properties:
error:
$ref: '#/components/schemas/ComplianceErrorBody'
type: object
required:
- error
title: ComplianceErrorResponse
ComplianceApp:
properties:
id:
type: string
title: Id
description: Unique ID of the app.
example: 68a1f3c2b7d9e4005c20e8f6
name:
type: string
title: Name
description: Name of the app.
example: Acme Invoice Tracker
app_type:
type: string
title: App Type
description: >-
Type of the app. Possible values are `"user_app"`, `"user_agent"`,
`"grow"`, `"mobile_app"`, `"user_game"`, `"slide"`,
`"imported_app"`, and `"user_workflows"`. A `user_agent` app is a
[Superagent](/Getting-Started/superagent).
example: user_app
owner:
$ref: '#/components/schemas/ComplianceAppUser'
description: Details of the app owner.
created_by:
$ref: '#/components/schemas/ComplianceAppUser'
description: Details of the member who created the app.
created_date:
anyOf:
- type: string
format: date-time
- type: 'null'
title: Created Date
description: >-
When the app was created. Formatted as a UTC timestamp in ISO 8601
format. A `null` value indicates no creation time is recorded.
example: '2026-02-10T08:41:09Z'
is_deleted:
type: boolean
title: Is Deleted
description: Whether the app was deleted.
example: false
is_blocked:
type: boolean
title: Is Blocked
description: Whether the app is blocked. People can't open a blocked app.
example: false
published:
type: boolean
title: Published
description: >-
Whether the app is currently published. This is `false` for an app
that was never published and for an app that was unpublished.
example: true
last_published_at:
anyOf:
- type: string
format: date-time
- type: 'null'
title: Last Published At
description: >-
When the app was last published. Formatted as a UTC timestamp in ISO
8601 format. A `null` value indicates the app was never published.
example: '2026-03-02T12:15:30Z'
serving_hostname:
anyOf:
- type: string
- type: 'null'
title: Serving Hostname
description: >-
Hostname the app is served on. This is the app's verified [custom
domain](/Setting-up-your-app/Setting-up-your-custom-domain) if it
has one, and its Base44 hostname otherwise.
example: invoices.acme.com
visibility_configured:
type: string
title: Visibility Configured
description: >-
Who can open the app, as set in the app's settings. Possible values
are `"public_without_login"`, `"public_with_login"`,
`"workspace_with_login"`, and `"private_with_login"`.
- `public_without_login`: Public, no login. Anyone on the internet.
No account needed.
- `public_with_login`: Public, login required. Anyone who signs in
with one of the app's enabled sign-in methods, including people
outside the workspace.
- `workspace_with_login`: Workspace. Everyone in the Base44
workspace.
- `private_with_login`: Private. Only invited people.
See [managing apps in your enterprise
workspace](/Enterprise/Enterprise-SSO-and-app-visibility).
example: workspace_with_login
visibility_effective:
type: string
title: Visibility Effective
description: >-
Who can open the app in practice. This differs from
`visibility_configured` when the workspace requires single sign-on
(SSO) for apps, because an app set to `"public_without_login"` then
requires sign-in. To check, see `sso.enforced_for_apps` in the
[workspace
configuration](/api-reference/compliance/get-workspace-configuration).
Possible values are the same as for `visibility_configured`.
example: workspace_with_login
draft_visibility:
anyOf:
- type: string
- type: 'null'
title: Draft Visibility
description: >-
Visibility saved in the app's draft settings, which applies when the
app is next published. A `null` value indicates no draft setting
exists.
example: private_with_login
auth:
$ref: '#/components/schemas/ComplianceAppAuth'
description: How people sign in to the app.
has_secrets:
type: boolean
title: Has Secrets
description: >-
Whether the app has secrets. Names and values aren't returned here.
To see the names, use the [List
secrets](/api-reference/compliance/list-secrets) method.
default: false
example: true
agent_active:
type: boolean
title: Agent Active
description: >-
Whether the app has an AI agent. A Superagent always counts as
having one.
example: false
backend_functions_enabled:
type: boolean
title: Backend Functions Enabled
description: >-
Whether the app has backend functions turned on. This can be `true`
even when the app has no deployed functions.
example: true
repo:
anyOf:
- $ref: '#/components/schemas/ComplianceAppRepo'
- type: 'null'
description: >-
Details of the GitHub repository connected to the app. A `null`
value indicates no repository is connected.
prevent_iframe_embedding:
type: boolean
title: Prevent Iframe Embedding
description: >-
Whether the app's own setting blocks other websites from showing it
in a frame. Workspace settings can also block framing. To see the
policy in force, use `embedding_policy.effective_origins`.
example: false
embedding_policy:
$ref: '#/components/schemas/ComplianceAppEmbeddingPolicy'
description: Which websites can show the app in a frame.
restrict_browser_features:
type: boolean
title: Restrict Browser Features
description: >-
Whether the app limits which browser features its pages can use.
Base44 does this with the `Permissions-Policy` response header.
example: false
dev_environment_enabled:
type: boolean
title: Dev Environment Enabled
description: >-
Whether the app has test data enabled. The app gets a test database
next to its live database, so you can try changes without touching
live data.
example: false
byom_enabled:
type: boolean
title: Byom Enabled
description: >-
Whether the app stores its data in the workspace's own MongoDB
database. See [connecting your own
MongoDB](/Enterprise/connecting-your-own-mongodb).
example: false
data_region:
type: string
title: Data Region
description: >-
Region where the app's data is stored. Possible values are `"US"`,
`"EU"`, `"UK"`, `"AU"`, and `"CUSTOMER_CLUSTER"`. A value of
`"CUSTOMER_CLUSTER"` indicates the app uses the workspace's own
MongoDB database.
example: US
type: object
required:
- id
- name
- app_type
- owner
- created_by
- is_deleted
- is_blocked
- published
- visibility_configured
- visibility_effective
- auth
- agent_active
- backend_functions_enabled
- prevent_iframe_embedding
- embedding_policy
- restrict_browser_features
- dev_environment_enabled
- byom_enabled
- data_region
title: ComplianceApp
PublicPaginationInfo:
properties:
total:
type: integer
title: Total
description: Total number of matching items.
example: 347
next_cursor:
anyOf:
- type: string
- type: 'null'
title: Next Cursor
description: >-
Cursor for fetching the next page. The value is `null` if there are
no more pages.
example: gAAAAABn7vJ...
has_more:
type: boolean
title: Has More
description: Whether there are more items to fetch.
example: true
type: object
required:
- total
- has_more
title: PublicPaginationInfo
description: Pagination metadata for a cursor-paginated page.
ComplianceErrorBody:
properties:
type:
type: string
title: Type
description: >-
Category of the error. See [error
types](/developers/references/compliance-api/get-started/error-codes#error-types).
example: permission_error
message:
type: string
title: Message
description: Explanation of the error for people to read.
example: >-
This API key is not permitted to perform that request. Needed:
[compliance:members:read]
code:
anyOf:
- type: string
- type: 'null'
title: Code
description: >-
Specific cause of the error, such as `missing_scope`,
`workspace_mismatch`, `plan_not_included`, `feature_not_enabled`,
`partner_key_required`, `partner_not_approved`, or
`inventory_too_large`. Omitted when `type` is enough. See
[Compliance API
codes](/developers/references/compliance-api/get-started/error-codes#compliance-api-codes).
example: missing_scope
required_scope:
anyOf:
- type: string
- type: 'null'
title: Required Scope
description: >-
Scope the method needs. Included only when `code` is
`missing_scope`.
example: compliance:members:read
type: object
required:
- type
- message
title: ComplianceErrorBody
ComplianceAppUser:
properties:
id:
anyOf:
- type: string
- type: 'null'
title: Id
description: Unique ID of the person's Base44 account.
example: 679e0f3a8b1c2d004a73f5b8
email:
anyOf:
- type: string
- type: 'null'
title: Email
description: >-
Email address of the person. A `null` value indicates Base44 has no
email recorded.
example: owner@acme.com
type: object
title: ComplianceAppUser
ComplianceAppAuth:
properties:
login_required:
type: boolean
title: Login Required
description: >-
Whether people must sign in to use the app. This can be `false`
while `methods` has values, because an app can offer sign-in without
requiring it.
example: true
methods:
items:
type: string
type: array
title: Methods
description: >-
Sign-in methods enabled for the app. Possible values are
`"username_password"`, `"google"`, `"microsoft"`, `"facebook"`,
`"apple"`, and `"sso"`. If the workspace requires SSO for apps, only
SSO works, whatever this list shows. To check, see
`sso.enforced_for_apps` in the [workspace
configuration](/api-reference/compliance/get-workspace-configuration).
example:
- google
- sso
sso:
$ref: '#/components/schemas/ComplianceAppSso'
description: >-
SSO settings for the app. See [single sign-on for enterprise
workspaces](/Enterprise/SSO-for-enterprise-workspace).
type: object
required:
- login_required
- methods
- sso
title: ComplianceAppAuth
ComplianceAppRepo:
properties:
provider:
anyOf:
- type: string
- type: 'null'
title: Provider
description: Service that hosts the repository. Always `"github"`.
example: github
full_name:
anyOf:
- type: string
- type: 'null'
title: Full Name
description: Full name of the repository, including the organization.
example: acme/invoice-tracker
org_name:
anyOf:
- type: string
- type: 'null'
title: Org Name
description: Name of the GitHub organization that owns the repository.
example: acme
url:
anyOf:
- type: string
- type: 'null'
title: Url
description: URL of the repository.
example: https://github.com/acme/invoice-tracker
default_branch:
anyOf:
- type: string
- type: 'null'
title: Default Branch
description: >-
Default branch of the repository. Base44 doesn't store the
production branch, so use this as the closest indicator.
example: main
connection_status:
anyOf:
- type: string
- type: 'null'
title: Connection Status
description: >-
Status of the connection to GitHub. Possible values are `"active"`,
`"disconnected"`, `"error"`, and `"revoked"`.
- `active`: The connection works normally.
- `disconnected`: A person disconnected the repository.
- `error`: The connection hit a technical failure.
- `revoked`: GitHub access was withdrawn.
example: active
sync_enabled:
anyOf:
- type: boolean
- type: 'null'
title: Sync Enabled
description: Whether Base44 keeps the app and the repository in sync.
example: true
last_sync_at:
anyOf:
- type: string
format: date-time
- type: 'null'
title: Last Sync At
description: >-
When the app and the repository last synced. Formatted as a UTC
timestamp in ISO 8601 format. A `null` value indicates no sync is
recorded.
example: '2026-04-18T10:02:44Z'
type: object
title: ComplianceAppRepo
ComplianceAppEmbeddingPolicy:
properties:
configured_origins:
anyOf:
- items:
type: string
type: array
- type: 'null'
title: Configured Origins
description: >-
Websites allowed to embed the app, as set for the app itself. A
`null` value indicates none is set.
example:
- https://portal.acme.com
workspace_origins:
anyOf:
- items:
type: string
type: array
- type: 'null'
title: Workspace Origins
description: >-
Websites the workspace allows to embed its apps. A `null` value
indicates the workspace sets no list.
example:
- https://acme.com
effective_origins:
anyOf:
- items:
type: string
type: array
- type: 'null'
title: Effective Origins
description: >-
Websites that can embed the app in practice. A `null` value
indicates any website can. An empty list indicates none can.
App-authored CSP, the content security policy that the app sets
itself, can restrict embedding further.
example:
- https://portal.acme.com
source:
type: string
enum:
- app
- workspace
- default
title: Source
description: |-
Where the embedding policy in force comes from. Possible values are:
- `app`: The app's own embedding settings apply.
- `workspace`: The workspace's embedding settings apply.
- `default`: Base44's default applies.
example: app
type: object
required:
- configured_origins
- workspace_origins
- effective_origins
- source
title: ComplianceAppEmbeddingPolicy
ComplianceAppSso:
properties:
enabled:
type: boolean
title: Enabled
description: Whether SSO is active for the app.
example: true
provider_name:
anyOf:
- type: string
- type: 'null'
title: Provider Name
description: >-
Name of the identity provider set on the app. A `null` value
indicates the app has no app-level provider. Apps that use workspace
SSO inherit the provider from the workspace configuration.
example: Okta
uses_workspace_sso:
type: boolean
title: Uses Workspace Sso
description: Whether the app uses the workspace's SSO setup.
example: true
type: object
required:
- enabled
- uses_workspace_sso
title: ComplianceAppSso
securitySchemes:
ApiKeyAuth:
type: apiKey
in: header
name: api_key
description: >-
Identifies the workspace you can read and limits your access to the
key's scopes. A workspace owner or admin creates the key and shares it
with you. See [Workspace API
key](/developers/references/compliance-api/get-started/authentication#workspace-api-key)
for more details.
PartnerTokenAuth:
type: http
scheme: bearer
bearerFormat: JWT
description: >-
The signed authentication token that identifies you as the security
partner. Sign a new token for each request with your signing key, using
`RS256` or `ES256`, and send it as a bearer token in the `Authorization`
header. See [Sign an authentication
token](/developers/references/compliance-api/get-started/authentication#sign-an-authentication-token)
for more details.
````
This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.