# list_apps

Source: <https://everruns.com/docs/api/operations/list_apps/>

Deprecated

GET

/v1/apps

Select code samplecURL (shell:curl)

```js
const url = 'https://app.everruns.com/api/v1/apps';
const options = {method: 'GET'};


try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}
```

```sh
curl --request GET \
  --url https://app.everruns.com/api/v1/apps
```

* Production APIapp.everruns.com/api/v1/apps

List archival App records. This endpoint is read-only and deprecated.

## Parameters

### Query Parameters

**search**

string | null

Search by name or description (case-insensitive substring match).

**include\_archived**

boolean | null

Include archived apps. Deleted apps never appear in lists.

## Responses

### 200

Archival list of Apps

Media typeapplication/json

Response wrapper for list endpoints. All list endpoints return responses wrapped in a `data` field.

object

**data**

required

Array of items returned by the list operation.

Array

Wrapper that adds API and UI links to a serialized resource.

Uses `self_url` (not `url`) for the API link to avoid collision with resources that already have a `url` field (e.g. McpServer). The `allowed_actions` array carries state-aware hypermedia links — empty (and omitted from the wire shape) until the underlying resource opts into the convention by overriding `ResourceUrlable::allowed_actions`.

object

**agent\_id**

Optional ID of the agent to use (format: agent\_{32-hex}).

string | null

**archived\_at**

Timestamp when the app was archived.

string | null format: date-time

**channels**

Distribution channels attached to this app.

Array\<object>

An independently published communication channel owned by an Agent. Each channel has its own type, config, and lifecycle status.

object

**auth**

One of:

* object

  Authentication policy for this channel.

  object

  **mode**

  required

  Agent channel authentication mode.

  Stored on `AgentChannel.auth` so users can protect one endpoint without first creating org-level identity-provider state.

  string

  Allowed values: anonymous shared\_secret api\_key google\_oidc oidc oauth2\_introspection http\_basic mtls

  **provider**

  One of:

  * object

    One of:

    * object

      object

      **allowed\_domains**

      Array\<string>

      **client\_id**

      required

      string

      **type**

      required

      string

      Allowed values: google\_oidc

    * object

      object

      **issuer**

      required

      string

      **jwks\_url**

      string | null

      **type**

      required

      string

      Allowed values: oidc

    * object

      object

      **client\_id**

      string | null

      **client\_secret**

      string | null

      **client\_secret\_configured**

      boolean

      **introspection\_url**

      required

      string

      **type**

      required

      string

      Allowed values: oauth2\_introspection

    * object

      object

      **password**

      string | null

      **password\_configured**

      boolean

      **password\_hash**

      string | null

      **type**

      required

      string

      Allowed values: http\_basic

      **username**

      required

      string

    * object

      object

      **allowed\_values**

      Array\<string>

      **header\_name**

      required

      string

      **proxy\_secret**

      Shared secret the trusted proxy includes in `proxy_secret_header`. Write-only: redacted in GET responses. See TM-AUTH-021.

      string | null

      **proxy\_secret\_configured**

      boolean

      **proxy\_secret\_header**

      Header the trusted reverse proxy uses to prove its identity. Required. Configs without this field fail closed at verification time.

      string | null

      **type**

      required

      string

      Allowed values: mtls

  * null

    object

    **allowed\_domains**

    Array\<string>

    **client\_id**

    required

    string

    **type**

    required

    string

    Allowed values: google\_oidc

  * object

    object

    **issuer**

    required

    string

    **jwks\_url**

    string | null

    **type**

    required

    string

    Allowed values: oidc

  * object

    object

    **client\_id**

    string | null

    **client\_secret**

    string | null

    **client\_secret\_configured**

    boolean

    **introspection\_url**

    required

    string

    **type**

    required

    string

    Allowed values: oauth2\_introspection

  * object

    object

    **password**

    string | null

    **password\_configured**

    boolean

    **password\_hash**

    string | null

    **type**

    required

    string

    Allowed values: http\_basic

    **username**

    required

    string

  * object

    object

    **allowed\_values**

    Array\<string>

    **header\_name**

    required

    string

    **proxy\_secret**

    Shared secret the trusted proxy includes in `proxy_secret_header`. Write-only: redacted in GET responses. See TM-AUTH-021.

    string | null

    **proxy\_secret\_configured**

    boolean

    **proxy\_secret\_header**

    Header the trusted reverse proxy uses to prove its identity. Required. Configs without this field fail closed at verification time.

    string | null

    **type**

    required

    string

    Allowed values: mtls

  * object

    null

  **requirements**

  Claim and credential requirements common to channel auth providers.

  object

  **audiences**

  JWT `aud` values to require on inbound tokens. Empty list disables audience checking.

  Array\<string>

  **claims**

  Arbitrary claim equality predicates. Empty map disables claim filtering.

  object

  ***key***

  additional properties

  **domains**

  Allowlist of email/identifier domains. Empty list disables domain filtering.

  Array\<string>

  **groups**

  Allowlist of group memberships (from `groups` claim). Empty list disables group filtering.

  Array\<string>

  **scopes**

  OAuth scope strings to require (space-delimited per scope entry). Empty list disables scope checking.

  Array\<string>

  **subjects**

  Allowlist of `sub` claim values. Empty list disables subject filtering.

  Array\<string>

* null

  One of:

  * object

    object

    **allowed\_domains**

    Array\<string>

    **client\_id**

    required

    string

    **type**

    required

    string

    Allowed values: google\_oidc

  * object

    object

    **issuer**

    required

    string

    **jwks\_url**

    string | null

    **type**

    required

    string

    Allowed values: oidc

  * object

    object

    **client\_id**

    string | null

    **client\_secret**

    string | null

    **client\_secret\_configured**

    boolean

    **introspection\_url**

    required

    string

    **type**

    required

    string

    Allowed values: oauth2\_introspection

  * object

    object

    **password**

    string | null

    **password\_configured**

    boolean

    **password\_hash**

    string | null

    **type**

    required

    string

    Allowed values: http\_basic

    **username**

    required

    string

  * object

    object

    **allowed\_values**

    Array\<string>

    **header\_name**

    required

    string

    **proxy\_secret**

    Shared secret the trusted proxy includes in `proxy_secret_header`. Write-only: redacted in GET responses. See TM-AUTH-021.

    string | null

    **proxy\_secret\_configured**

    boolean

    **proxy\_secret\_header**

    Header the trusted reverse proxy uses to prove its identity. Required. Configs without this field fail closed at verification time.

    string | null

    **type**

    required

    string

    Allowed values: mtls

* object

  object

  **allowed\_domains**

  Array\<string>

  **client\_id**

  required

  string

  **type**

  required

  string

  Allowed values: google\_oidc

* null

  object

  **issuer**

  required

  string

  **jwks\_url**

  string | null

  **type**

  required

  string

  Allowed values: oidc

* object

  object

  **client\_id**

  string | null

  **client\_secret**

  string | null

  **client\_secret\_configured**

  boolean

  **introspection\_url**

  required

  string

  **type**

  required

  string

  Allowed values: oauth2\_introspection

* object

  object

  **password**

  string | null

  **password\_configured**

  boolean

  **password\_hash**

  string | null

  **type**

  required

  string

  Allowed values: http\_basic

  **username**

  required

  string

* object

  object

  **allowed\_values**

  Array\<string>

  **header\_name**

  required

  string

  **proxy\_secret**

  Shared secret the trusted proxy includes in `proxy_secret_header`. Write-only: redacted in GET responses. See TM-AUTH-021.

  string | null

  **proxy\_secret\_configured**

  boolean

  **proxy\_secret\_header**

  Header the trusted reverse proxy uses to prove its identity. Required. Configs without this field fail closed at verification time.

  string | null

  **type**

  required

  string

  Allowed values: mtls

* object

  null

* object

  null

**channel\_config**

Channel-specific configuration (validated per channel type).

**channel\_type**

required

Channel type (e.g. slack).

string

Allowed values: slack ag\_ui schedule webhook a2a fcp public\_chat voice api poppy

**created\_at**

required

Timestamp when this channel was created.

string format: date-time

**enabled**

Whether this channel is enabled.

boolean

**id**

required

External identifier (appchan\_<32-hex>). Shown as “id” in API.

string

**status**

Per-channel lifecycle. Authoritative for ingress (EVE-1007); `enabled` is retained for the App API’s existing shape.

string

Allowed values: draft live disabled

**updated\_at**

required

Timestamp when this channel was last updated.

string format: date-time

**created\_at**

required

Timestamp when the app was created.

string format: date-time

**deleted\_at**

Timestamp when the app was deleted.

string | null format: date-time

**description**

Human-readable description of what the app does.

string | null

**effective\_owner**

One of:

* object

  Effective human owner summary.

  object

  **id**

  required

  string

  **kind**

  required

  Class of principal that can hold permissions or own resources. `system` is reserved for platform-internal callers and is never minted via the public API.

  string

  Allowed values: user virtual\_user system

  **metadata**

  **subject\_id**

  string | null format: uuid

* null

  null

**harness\_id**

required

ID of the harness to use (format: harness\_{32-hex}).

string

**id**

required

External identifier (app\_<32-hex>). Shown as “id” in API.

string

**name**

required

Display name of the app.

string

**owner**

One of:

* object

  Owning principal summary.

  object

  **id**

  required

  string

  **kind**

  required

  Class of principal that can hold permissions or own resources. `system` is reserved for platform-internal callers and is never minted via the public API.

  string

  Allowed values: user virtual\_user system

  **metadata**

  **subject\_id**

  string | null format: uuid

* null

  null

**owner\_principal\_id**

required

Owning principal for this app.

string

**published\_at**

Timestamp when the app was last published.

string | null format: date-time

**resolved\_owner\_user\_id**

Denormalized effective human owner of the owning principal lineage.

string | null format: uuid

**status**

required

Current lifecycle status.

string

Allowed values: draft published archived deleted

**updated\_at**

required

Timestamp when the app was last updated.

string format: date-time

**virtual\_user\_id**

Optional virtual identity that represents the app in unattended/channel execution.

string | null

**allowed\_actions**

State-aware hypermedia actions the caller can take on this resource next (e.g. `cancel`, `events`, `update`). Omitted from the wire shape when empty so resources that haven’t opted into the convention don’t grow their payloads.

Array\<object>

Agent-actionable link describing a follow-up the caller can take. Used in two contexts:

* **Error recovery** — `ErrorResponse.allowed_actions` carries `rel`s like `retry`, `retry-later`, `unarchive`, `get-existing` so the agent knows the right next call after a 4xx/429.
* **Entity hypermedia** — `WithUrls<T>.allowed_actions` carries state-aware `rel`s like `cancel`, `events`, `self`, `update` on the entity itself so the agent can follow links instead of reconstructing routes from prose.

The shape is intentionally identical across both contexts; the closed `rel` vocabulary distinguishes them.

object

**hint**

Short, agent-readable hint (e.g. “Shorten ‘name’ to <= 200 chars.”, “Cancel the active turn for this session.”).

string | null

**href**

Absolute (preferred) or relative URL the caller may invoke directly. **Always present on entity hypermedia actions** (`WithUrls<T>.allowed_actions`); **optional on error-recovery actions** (`ErrorResponse.allowed_actions`) where the matching `operation_id` is enough and the URI is implicit from the failed call.

string | null

**method**

HTTP method to use against `href`. Required for entity hypermedia actions; usually omitted on error-recovery actions where the same operation is retried with its original method.

string | null

**operation\_id**

OpenAPI `operationId` the caller should invoke. Lets an MCP client resolve the call without parsing `href`.

string | null

**rel**

required

Link relation describing the action. Examples: `self`, `cancel`, `pause`, `resume`, `events`, `retry`, `retry-later`, `unarchive`, `get-existing`, `delete`, `update`.

string

**schema\_ref**

OpenAPI `$ref` to the request-body schema, when the action takes one (e.g. `#/components/schemas/UpdateSessionRequest`). Lets a tool-calling agent fetch the input shape without scanning the whole spec.

string | null

**self\_url**

required

Full API endpoint URL for this resource.

string

**ui\_link**

required

Alias for `view_url`, used by command and MCP outputs.

string

**view\_url**

required

Full UI URL for viewing this resource.

string

##### Example

```json
{
  "data": [
    {
      "agent_id": "agent_01933b5a00007000800000000000001",
      "channels": [
        {
          "auth": {
            "mode": "api_key",
            "requirements": {
              "audiences": [
                "everruns-api"
              ],
              "scopes": [
                "app:invoke"
              ]
            }
          },
          "channel_type": "slack",
          "id": "appchan_01933b5a000070008000000000000001",
          "status": "draft"
        }
      ],
      "effective_owner": {
        "id": "principal_01933b5a000070008000000000000001",
        "kind": "user"
      },
      "harness_id": "harness_01933b5a00007000800000000000001",
      "id": "app_01933b5a000070008000000000000001",
      "owner": {
        "id": "principal_01933b5a000070008000000000000001",
        "kind": "user"
      },
      "owner_principal_id": "principal_01933b5a000070008000000000000001",
      "status": "draft",
      "virtual_user_id": "identity_01933b5a00007000800000000000001",
      "allowed_actions": [
        {
          "method": "POST"
        }
      ]
    }
  ]
}
```

### 500

Internal server error