REST API: Apps
Generated from the daemon’s OpenAPI document. Conventions, sign-in, the CSRF header and the WebSocket are on API.
GET /api/apps
Section titled “GET /api/apps”Administrators only. Every installed app with its manifest, permissions, uid and state, and the app pool. The topic apps/admin carries the same and its changes.
Responses
- 200:
application/json: AdminAppList
Any failure answers with problem details (application/problem+json) and a stable code from the error reference.
PATCH /api/apps/{appId}
Section titled “PATCH /api/apps/{appId}”Administrators only. Enables or disables an app. A disabled app keeps its data and grants, but nobody can open it, its frontend is not served and its tokens end.
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
appId |
path | string | yes |
Request body: application/json: UpdateAppRequest
Responses
- 200:
application/json: AppDetails
Any failure answers with problem details (application/problem+json) and a stable code from the error reference.
DELETE /api/apps/{appId}
Section titled “DELETE /api/apps/{appId}”Administrators only. Removes an app as a job and answers 202 with it: data=keep removes its frontends and keeps its data on the app pool for a later install of the same app, data=delete destroys its dataset with every snapshot. Its grants go either way.
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
appId |
path | string | yes | |
data |
query | string | yes |
Responses
- 202:
application/json: Job
Any failure answers with problem details (application/problem+json) and a stable code from the error reference.
GET /api/apps/{appId}/grants
Section titled “GET /api/apps/{appId}/grants”Administrators only. Who may use an installed third-party app: the grants of users and groups on app:
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
appId |
path | string | yes |
Responses
- 200:
application/json: AppGrants
Any failure answers with problem details (application/problem+json) and a stable code from the error reference.
PUT /api/apps/{appId}/grants
Section titled “PUT /api/apps/{appId}/grants”Administrators only. Replaces the grants of users and groups on the app, each with level allow; without any, only administrators use it. Applies at once and is pushed to the users’ desktops.
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
appId |
path | string | yes |
Request body: application/json: AppGrantsRequest
Responses
- 200:
application/json: AppGrants
Any failure answers with problem details (application/problem+json) and a stable code from the error reference.
GET /api/apps/{appId}/icon
Section titled “GET /api/apps/{appId}/icon”The icon of an app the user may use (any app for administrators), served with Content-Security-Policy: default-src ‘none’; sandbox.
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
appId |
path | string | yes |
Responses
- 200:
image/svg+xml: string (byte)
Any failure answers with problem details (application/problem+json) and a stable code from the error reference.
PUT /api/apps/{appId}/log-level
Section titled “PUT /api/apps/{appId}/log-level”Administrators only. Switches the app’s debug log entries on (debug) or off (info, the default); info, warn and error always reach the Log Center. The topic apps carries the level to the app’s windows.
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
appId |
path | string | yes |
Request body: application/json: AppLogLevelRequest
Responses
- 200:
application/json: AppDetails
Any failure answers with problem details (application/problem+json) and a stable code from the error reference.
PUT /api/apps/{appId}/permissions
Section titled “PUT /api/apps/{appId}/permissions”Administrators only. Grants or revokes permissions the app’s manifest asks for (app.permission.not_requested for any other); the listed ones change, the others stay. A revoked permission stays revoked across updates. Users’ windows of the app learn it with their next token (A11).
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
appId |
path | string | yes |
Request body: application/json: AppPermissionsRequest
Responses
- 200:
application/json: AppDetails
Any failure answers with problem details (application/problem+json) and a stable code from the error reference.
POST /api/apps/{appId}/rollback
Section titled “POST /api/apps/{appId}/rollback”Administrators only. Goes back to the version before the app’s last update as a job: the app’s dataset returns to the snapshot of that update, so its data goes back too, and the previous version runs again (app.app.no_previous without one).
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
appId |
path | string | yes |
Responses
- 202:
application/json: Job
Any failure answers with problem details (application/problem+json) and a stable code from the error reference.
PUT /api/apps/{appId}/storage/{storageId}
Section titled “PUT /api/apps/{appId}/storage/{storageId}”Administrators only. Maps an existing folder of a shared folder to a storage request of the app’s manifest, replacing an earlier mapping: read-only, or read and write when the request asks for it (app.mapping.invalid otherwise). The folder keeps its rights, snapshots and backups and survives an uninstall.
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
appId |
path | string | yes | |
storageId |
path | string | yes |
Request body: application/json: AppStorageMappingRequest
Responses
- 200:
application/json: AppDetails
Any failure answers with problem details (application/problem+json) and a stable code from the error reference.
DELETE /api/apps/{appId}/storage/{storageId}
Section titled “DELETE /api/apps/{appId}/storage/{storageId}”Administrators only. Removes the folder mapped to a storage request of the app; the folder itself stays.
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
appId |
path | string | yes | |
storageId |
path | string | yes |
Responses
- 200:
application/json: AppDetails
Any failure answers with problem details (application/problem+json) and a stable code from the error reference.
POST /api/apps/{appId}/tokens
Section titled “POST /api/apps/{appId}/tokens”A token for an app the signed-in user may use (any app for administrators; app.app.not_found otherwise), bound to the user, this session, the app and the window instance, valid 5 minutes. kind host is for the daemon’s API for apps (/api/app/**) and stays in the desktop; kind backend is for the app’s backend (app.backend.missing without one). Needs the session cookie and the CSRF header; ask again before expiresAt.
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
appId |
path | string | yes |
Request body: application/json: AppTokenRequest
Responses
- 200:
application/json: AppToken
Any failure answers with problem details (application/problem+json) and a stable code from the error reference.
PUT /api/apps/{appId}/update-policy
Section titled “PUT /api/apps/{appId}/update-policy”Administrators only. The app’s own update policy (automatic, notify, none), or null to follow the box’s.
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
appId |
path | string | yes |
Request body: application/json: AppUpdatePolicyRequest
Responses
- 200:
application/json: AppDetails
Any failure answers with problem details (application/problem+json) and a stable code from the error reference.
PUT /api/apps/packages
Section titled “PUT /api/apps/packages”Administrators only. Streams an app package (
Responses
- 200:
application/json: AppPackagePreview
Any failure answers with problem details (application/problem+json) and a stable code from the error reference.
GET /api/apps/packages/{packageId}
Section titled “GET /api/apps/packages/{packageId}”Administrators only. The check result of an uploaded package again, while it is kept (app.package.not_found otherwise).
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
packageId |
path | string | yes |
Responses
- 200:
application/json: AppPackagePreview
Any failure answers with problem details (application/problem+json) and a stable code from the error reference.
DELETE /api/apps/packages/{packageId}
Section titled “DELETE /api/apps/packages/{packageId}”Administrators only. Discards an uploaded package without installing it.
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
packageId |
path | string | yes |
Responses
- 204
Any failure answers with problem details (application/problem+json) and a stable code from the error reference.
POST /api/apps/packages/{packageId}/install
Section titled “POST /api/apps/packages/{packageId}/install”Administrators only. Installs or updates the app from an uploaded package as a job and answers 202 with it. The first app needs pool, the pool for every app’s data; access (everybody by default) decides who may use a newly installed app. An update takes a snapshot of the app’s dataset first and returns to it when a step fails.
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
packageId |
path | string | yes |
Request body: application/json: InstallAppRequest
Responses
- 202:
application/json: Job
Any failure answers with problem details (application/problem+json) and a stable code from the error reference.