> ## Documentation Index
> Fetch the complete documentation index at: https://docs.base44.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Apps and domains

> App inventory and custom domain endpoints in the Compliance API

## Apps

`GET /{workspace_id}/apps`

Returns a paginated list of every app in the workspace, including standalone AI agents. Requires `compliance:inventory:read`. Deleted and blocked apps are included and flagged. Their domains, secrets, and integrations may still exist, and omitting them would under-report the workspace's surface.

| Field | Type | Notes |
| - | - | - |
| `id` | string | App ID. |
| `name` | string | |
| `app_type` | string | One of `user_app`, `user_agent`, `mobile_app`, `user_game`, `slide`, or `imported_app`. Unrecognized values normalize to `user_app`. |
| `owner`, `created_by` | object | `{ id, email }`. |
| `created_date` | timestamp or null | |
| `is_deleted` | boolean | Soft-deleted apps remain listed. |
| `is_blocked` | boolean | Platform-blocked. |
| `published` | boolean | Deployed at least once and not since unpublished. |
| `last_published_at` | timestamp or null | |
| `serving_hostname` | string or null | Verified custom domain, else the default Base44 hostname. |
| `visibility_configured` | string | One of `public_without_login`, `public_with_login`, `workspace_with_login`, `private_with_login`, and possibly further values. |
| `visibility_effective` | string | After workspace SSO enforcement, and can be stricter than configured. Alert on this one. |
| `draft_visibility` | string or null | A staged change not yet applied. |
| `auth.login_required` | boolean | Whether reaching the app requires a signed-in app user. |
| `auth.methods[]` | array of strings | Any of `username_password`, `google`, `microsoft`, `facebook`, `apple`, and `sso`. Configured, not effective. |
| `auth.sso` | object | `{ enabled, provider_name, uses_workspace_sso }`. |
| `has_secrets` | boolean | At least one app-scoped secret. |
| `agent_active` | boolean | True when the app is a Super Agent (`app_type` of `user_agent`) or contains in-app agents. A Super Agent reports true even with no agent configuration saved. |
| `backend_functions_enabled` | boolean | |
| `repo` | object or null | GitHub only today: `{ provider, full_name, org_name, url, default_branch, connection_status, sync_enabled, last_sync_at }`. |
| `prevent_iframe_embedding` | boolean | |
| `restrict_browser_features` | boolean | |
| `dev_environment_enabled` | boolean | |
| `byom_enabled` | boolean | The customer brings their own model or database configuration. |
| `data_region` | string | As in [Workspace](https://docs.base44.com/developers/references/compliance-api/get-started/workspace-and-members.md), including `CUSTOMER_CLUSTER`. |

### Reading exposure correctly

Registration is gated by visibility, not by login method. A public app mints an app user for anyone who authenticates, `workspace_with_login` admits workspace members only, and `private_with_login` needs an invitation or a group grant.

The `auth.methods` field then says how wide the pool behind that gate is. A non-SSO method means the internet, and SSO-only means the customer's directory. Join `sso.enforced_for_apps` from the workspace object first, though, because it overrides those methods at serve time.

The `repo.default_branch` field is the documented proxy for the production branch, which isn't stored.

## Domains

`GET /{workspace_id}/domains`

Returns a paginated union of custom serving domains and custom email domains, discriminated by `kind`. Requires `compliance:inventory:read`. The "Applies to" column says which rows carry each field.

| Field | Type | Applies to | Notes |
| - | - | - | - |
| `id` | string | Both | Composite `{kind}:{app_id}:{domain}`. |
| `kind` | string | Both | `serving` or `email`. |
| `domain`, `app_id` | string | Both | |
| `created_date` | timestamp or null | Both | Always null on email rows, because an email domain carries no creation time of its own. |
| `verified` | boolean | Serving | Derived from the provider's last status payload rather than a stored flag. |
| `last_checked_at` | timestamp or null | Serving | When that status was last read. |
| `enabled` | boolean | Serving | |
| `disabled_by` | string or null | Serving | `"admin"` or `"subscription"` when disabled. |
| `is_external` | boolean | Serving | Derived. The customer brought this domain rather than buying it through Base44. |
| `configuration_status` | string | Email | |
| `verified_at` | timestamp or null | Email | |
| `disabled` | boolean | Email | |
| `suspended` | object | Email | `{ flag, reason }`. |
| `external` | boolean | Email | A stored flag, unlike the serving side's derived `is_external`. |

```json theme={null}
{
  "data": [
    {
      "id": "serving:app_42:portal.acme.com",
      "kind": "serving",
      "domain": "portal.acme.com",
      "app_id": "app_42",
      "created_date": "2026-01-04T11:00:00Z",
      "verified": true,
      "last_checked_at": "2026-07-29T01:00:00Z",
      "enabled": true,
      "disabled_by": null,
      "is_external": false
    },
    {
      "id": "email:app_42:mail.acme.com",
      "kind": "email",
      "domain": "mail.acme.com",
      "app_id": "app_42",
      "created_date": null,
      "configuration_status": "verified",
      "verified_at": "2026-05-01T00:00:00Z",
      "disabled": false,
      "suspended": { "flag": false, "reason": null },
      "external": false
    }
  ],
  "pagination": { "total": 2, "next_cursor": null, "has_more": false }
}
```


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.