Apps and domains - Base44 Support Documentation

Apps

GET /{workspace_id}/apps Returns a paginated list of every app in the workspace, including standalone AI agents. Requires compliance:inventory:read. Deleted and blocked apps are included and flagged. Their domains, secrets, and integrations may still exist, and omitting them would under-report the workspace’s surface.

Field	Type	Notes
`id`	string	App ID.
`name`	string
`app_type`	string	One of `user_app`, `user_agent`, `mobile_app`, `user_game`, `slide`, or `imported_app`. Unrecognized values normalize to `user_app`.
`owner`, `created_by`	object	`{ id, email }`.
`created_date`	timestamp or null
`is_deleted`	boolean	Soft-deleted apps remain listed.
`is_blocked`	boolean	Platform-blocked.
`published`	boolean	Deployed at least once and not since unpublished.
`last_published_at`	timestamp or null
`serving_hostname`	string or null	Verified custom domain, else the default Base44 hostname.
`visibility_configured`	string	One of `public_without_login`, `public_with_login`, `workspace_with_login`, `private_with_login`, and possibly further values.
`visibility_effective`	string	After workspace SSO enforcement, and can be stricter than configured. Alert on this one.
`draft_visibility`	string or null	A staged change not yet applied.
`auth.login_required`	boolean	Whether reaching the app requires a signed-in app user.
`auth.methods[]`	array of strings	Any of `username_password`, `google`, `microsoft`, `facebook`, `apple`, and `sso`. Configured, not effective.
`auth.sso`	object	`{ enabled, provider_name, uses_workspace_sso }`.
`has_secrets`	boolean	At least one app-scoped secret.
`agent_active`	boolean	True when the app is a Super Agent (`app_type` of `user_agent`) or contains in-app agents. A Super Agent reports true even with no agent configuration saved.
`backend_functions_enabled`	boolean
`repo`	object or null	GitHub only today: `{ provider, full_name, org_name, url, default_branch, connection_status, sync_enabled, last_sync_at }`.
`prevent_iframe_embedding`	boolean
`restrict_browser_features`	boolean
`dev_environment_enabled`	boolean
`byom_enabled`	boolean	The customer brings their own model or database configuration.
`data_region`	string	As in Workspace, including `CUSTOMER_CLUSTER`.

Reading exposure correctly

Registration is gated by visibility, not by login method. A public app mints an app user for anyone who authenticates, workspace_with_login admits workspace members only, and private_with_login needs an invitation or a group grant. The auth.methods field then says how wide the pool behind that gate is. A non-SSO method means the internet, and SSO-only means the customer’s directory. Join sso.enforced_for_apps from the workspace object first, though, because it overrides those methods at serve time. The repo.default_branch field is the documented proxy for the production branch, which isn’t stored.

Domains

GET /{workspace_id}/domains Returns a paginated union of custom serving domains and custom email domains, discriminated by kind. Requires compliance:inventory:read. The “Applies to” column says which rows carry each field.

Field	Type	Applies to	Notes
`id`	string	Both	Composite `{kind}:{app_id}:{domain}`.
`kind`	string	Both	`serving` or `email`.
`domain`, `app_id`	string	Both
`created_date`	timestamp or null	Both	Always null on email rows, because an email domain carries no creation time of its own.
`verified`	boolean	Serving	Derived from the provider’s last status payload rather than a stored flag.
`last_checked_at`	timestamp or null	Serving	When that status was last read.
`enabled`	boolean	Serving
`disabled_by`	string or null	Serving	`"admin"` or `"subscription"` when disabled.
`is_external`	boolean	Serving	Derived. The customer brought this domain rather than buying it through Base44.
`configuration_status`	string	Email
`verified_at`	timestamp or null	Email
`disabled`	boolean	Email
`suspended`	object	Email	`{ flag, reason }`.
`external`	boolean	Email	A stored flag, unlike the serving side’s derived `is_external`.

{
  "data": [
    {
      "id": "serving:app_42:portal.acme.com",
      "kind": "serving",
      "domain": "portal.acme.com",
      "app_id": "app_42",
      "created_date": "2026-01-04T11:00:00Z",
      "verified": true,
      "last_checked_at": "2026-07-29T01:00:00Z",
      "enabled": true,
      "disabled_by": null,
      "is_external": false
    },
    {
      "id": "email:app_42:mail.acme.com",
      "kind": "email",
      "domain": "mail.acme.com",
      "app_id": "app_42",
      "created_date": null,
      "configuration_status": "verified",
      "verified_at": "2026-05-01T00:00:00Z",
      "disabled": false,
      "suspended": { "flag": false, "reason": null },
      "external": false
    }
  ],
  "pagination": { "total": 2, "next_cursor": null, "has_more": false }
}

​Apps

​Reading exposure correctly

​Domains

Apps

Reading exposure correctly

Domains