Appwrite Apps API

openapi: 3.0.0
info:
  title: Appwrite Apps API
  description: Appwrite backend as a service cuts up to 70% of the time and costs required for building a modern application. We abstract and simplify common development tasks behind a REST APIs, to help you develop your app in a fast and secure way. For full API documentation and tutorials go to [https://appwrite.io/docs](https://appwrite.io/docs)
  version: 2.0.0
  termsOfService: https://appwrite.io/policy/terms
  contact:
    name: Appwrite Team
    url: https://appwrite.io/support
    email: team@appwrite.io
  license:
    name: BSD-3-Clause
    url: https://raw.githubusercontent.com/appwrite/appwrite/master/LICENSE
servers:
- url: https://cloud.appwrite.io/v1
  description: Appwrite Cloud endpoint.
- url: https://{region}.cloud.appwrite.io/v1
  description: Appwrite Cloud regional endpoint. Replace `{region}` with your project region.
  variables:
    region:
      default: fra
      description: Appwrite Cloud region.
tags:
- name: apps
  description: The Apps service allows you to manage OAuth2 applications, their keys, secrets, scopes, and installations.
paths:
  /apps:
    get:
      summary: List Applications
      operationId: appsList
      tags:
      - apps
      description: List applications.
      responses:
        '200':
          description: Apps list
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/appsList'
      deprecated: false
      x-appwrite:
        group: apps
        demo: apps/list.md
        rate-limit: 120
        rate-time: 60
        rate-key: ip:{ip},userId:{userId}
        scope: apps.read
        platforms:
        - console
        - client
        - server
        packaging: false
        public: true
        auth:
          console:
            Project: []
          client:
            Project: []
          server:
            Project: []
            Session: []
      security:
      - Project: []
        Session: []
        Key: []
        JWT: []
      parameters:
      - name: queries
        description: Array of query strings generated using the Query class provided by the SDK. [Learn more about queries](https://appwrite.io/docs/queries). Maximum of 100 queries are allowed, each 4096 characters long.
        required: false
        schema:
          type: array
          items:
            type: string
          default: []
        in: query
      - name: total
        description: When set to false, the total count returned will be 0 and will not be calculated.
        required: false
        schema:
          type: boolean
          example: false
          default: true
        in: query
    post:
      summary: Create Application
      operationId: appsCreate
      tags:
      - apps
      description: Create a new application.
      responses:
        '201':
          description: App
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/app'
      deprecated: false
      x-appwrite:
        group: apps
        demo: apps/create.md
        rate-limit: 10
        rate-time: 60
        rate-key: ip:{ip},userId:{userId}
        scope: apps.write
        platforms:
        - console
        - client
        - server
        packaging: false
        public: true
        auth:
          console:
            Project: []
          client:
            Project: []
          server:
            Project: []
            Session: []
      security:
      - Project: []
        Session: []
        Key: []
        JWT: []
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                appId:
                  description: Application ID. Choose a custom ID or generate a random ID with `ID.unique()`. Valid chars are a-z, A-Z, 0-9, period, hyphen, and underscore. Can't start with a special char. Max length is 36 chars.
                  type: string
                  example: <APP_ID>
                  x-appwrite:
                    idGenerator: ID.unique
                name:
                  description: Application name.
                  type: string
                  example: <NAME>
                description:
                  description: Application description shown to users during OAuth2 consent.
                  type: string
                  default: ''
                  example: <DESCRIPTION>
                clientUri:
                  description: Application homepage URL shown to users during OAuth2 consent.
                  type: string
                  default: ''
                  example: https://example.com
                  format: url
                logoUri:
                  description: Application logo URL shown to users during OAuth2 consent.
                  type: string
                  default: ''
                  example: https://example.com
                  format: url
                privacyPolicyUrl:
                  description: Application privacy policy URL shown to users during OAuth2 consent.
                  type: string
                  default: ''
                  example: https://example.com
                  format: url
                termsUrl:
                  description: Application terms of service URL shown to users during OAuth2 consent.
                  type: string
                  default: ''
                  example: https://example.com
                  format: url
                contacts:
                  description: Application support or security contact emails. Maximum of 100 contacts are allowed.
                  type: array
                  default: []
                  items:
                    type: string
                tagline:
                  description: Application tagline shown to users during OAuth2 consent.
                  type: string
                  default: ''
                  example: <TAGLINE>
                tags:
                  description: Application tags shown to users during OAuth2 consent. Maximum of 100 tags are allowed, each up to 64 characters long.
                  type: array
                  default: []
                  items:
                    type: string
                images:
                  description: Application image URLs shown to users during OAuth2 consent. Maximum of 100 images are allowed.
                  type: array
                  default: []
                  items:
                    type: string
                supportUrl:
                  description: Application support URL shown to users during OAuth2 consent.
                  type: string
                  default: ''
                  example: https://example.com
                  format: url
                dataDeletionUrl:
                  description: Application data deletion URL shown to users during OAuth2 consent.
                  type: string
                  default: ''
                  example: https://example.com
                  format: url
                redirectUris:
                  description: Redirect URIs. Each must be an https URL, an http loopback URL (localhost, 127.0.0.1, [::1]), or a private-use scheme URI (e.g. com.example.app:/oauth), and must not contain a fragment.
                  type: array
                  items:
                    type: string
                postLogoutRedirectUris:
                  description: Post-logout redirect URIs for OpenID Connect RP-Initiated Logout. Each must be an https URL, an http loopback URL, or a private-use scheme URI, and must not contain a fragment. After ending the user session, the logout endpoint only redirects to URIs in this list.
                  type: array
                  default: []
                  items:
                    type: string
                enabled:
                  description: Is application enabled?
                  type: boolean
                  default: true
                  example: false
                type:
                  description: OAuth2 client type. Use `public` for SPAs, mobile, and native apps that cannot keep a `client_secret` — PKCE is then required at the token endpoint. Use `confidential` for server-side clients that present a `client_secret`. Defaults to `confidential`.
                  type: string
                  default: confidential
                  example: public
                deviceFlow:
                  description: Allow this client to use the OAuth2 Device Authorization Grant (RFC 8628) for input-constrained devices such as TVs and CLIs. Defaults to false.
                  type: boolean
                  default: false
                  example: false
                teamId:
                  description: Team unique ID.
                  type: string
                  default: ''
                  example: <TEAM_ID>
              required:
              - appId
              - name
              - redirectUris
  /apps/scopes/installations:
    get:
      summary: List Installation Scopes
      operationId: appsListInstallationScopes
      tags:
      - apps
      description: List scopes an application can request when installed on a team.
      responses:
        '200':
          description: App scopes list
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/appScopeList'
      deprecated: false
      x-appwrite:
        group: scopes
        demo: apps/list-installation-scopes.md
        rate-limit: 120
        rate-time: 60
        rate-key: ip:{ip},userId:{userId}
        scope: apps.read
        platforms:
        - console
        - client
        - server
        packaging: false
        public: true
        auth:
          console:
            Project: []
          client:
            Project: []
          server:
            Project: []
            Session: []
      security:
      - Project: []
        Session: []
        Key: []
        JWT: []
  /apps/scopes/oauth2:
    get:
      summary: List OAuth2 Scopes
      operationId: appsListOAuth2Scopes
      tags:
      - apps
      description: List scopes an application can request during the OAuth2 flow.
      responses:
        '200':
          description: App scopes list
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/appScopeList'
      deprecated: false
      x-appwrite:
        group: scopes
        demo: apps/list-o-auth-2-scopes.md
        rate-limit: 120
        rate-time: 60
        rate-key: ip:{ip},userId:{userId}
        scope: apps.read
        platforms:
        - console
        - client
        - server
        packaging: false
        public: true
        auth:
          console:
            Project: []
          client:
            Project: []
          server:
            Project: []
            Session: []
      security:
      - Project: []
        Session: []
        Key: []
        JWT: []
  /apps/{appId}:
    get:
      summary: Get Application
      operationId: appsGet
      tags:
      - apps
      description: Get an application by its unique ID.
      responses:
        '200':
          description: App
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/app'
      deprecated: false
      x-appwrite:
        group: apps
        demo: apps/get.md
        rate-limit: 120
        rate-time: 60
        rate-key: ip:{ip},userId:{userId}
        scope: apps.read
        platforms:
        - console
        - client
        - server
        packaging: false
        public: true
        auth:
          console:
            Project: []
          client:
            Project: []
          server:
            Project: []
            Session: []
      security:
      - Project: []
        Session: []
        Key: []
        JWT: []
      parameters:
      - name: appId
        description: Application unique ID.
        required: true
        schema:
          type: string
          example: <APP_ID>
        in: path
    put:
      summary: Update Application
      operationId: appsUpdate
      tags:
      - apps
      description: Update an application by its unique ID.
      responses:
        '200':
          description: App
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/app'
      deprecated: false
      x-appwrite:
        group: apps
        demo: apps/update.md
        rate-limit: 60
        rate-time: 60
        rate-key: ip:{ip},userId:{userId}
        scope: apps.write
        platforms:
        - console
        - client
        - server
        packaging: false
        public: true
        auth:
          console:
            Project: []
          client:
            Project: []
          server:
            Project: []
            Session: []
      security:
      - Project: []
        Session: []
        Key: []
        JWT: []
      parameters:
      - name: appId
        description: Application unique ID.
        required: true
        schema:
          type: string
          example: <APP_ID>
        in: path
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                name:
                  description: Application name.
                  type: string
                  example: <NAME>
                description:
                  description: Application description shown to users during OAuth2 consent.
                  type: string
                  default: ''
                  example: <DESCRIPTION>
                clientUri:
                  description: Application homepage URL shown to users during OAuth2 consent.
                  type: string
                  default: ''
                  example: https://example.com
                  format: url
                logoUri:
                  description: Application logo URL shown to users during OAuth2 consent.
                  type: string
                  default: ''
                  example: https://example.com
                  format: url
                privacyPolicyUrl:
                  description: Application privacy policy URL shown to users during OAuth2 consent.
                  type: string
                  default: ''
                  example: https://example.com
                  format: url
                termsUrl:
                  description: Application terms of service URL shown to users during OAuth2 consent.
                  type: string
                  default: ''
                  example: https://example.com
                  format: url
                contacts:
                  description: Application support or security contact emails. Maximum of 100 contacts are allowed.
                  type: array
                  default: []
                  items:
                    type: string
                tagline:
                  description: Application tagline shown to users during OAuth2 consent.
                  type: string
                  default: ''
                  example: <TAGLINE>
                tags:
                  description: Application tags shown to users during OAuth2 consent. Maximum of 100 tags are allowed, each up to 64 characters long.
                  type: array
                  default: []
                  items:
                    type: string
                images:
                  description: Application image URLs shown to users during OAuth2 consent. Maximum of 100 images are allowed.
                  type: array
                  default: []
                  items:
                    type: string
                supportUrl:
                  description: Application support URL shown to users during OAuth2 consent.
                  type: string
                  default: ''
                  example: https://example.com
                  format: url
                dataDeletionUrl:
                  description: Application data deletion URL shown to users during OAuth2 consent.
                  type: string
                  default: ''
                  example: https://example.com
                  format: url
                enabled:
                  description: Is application enabled?
                  type: boolean
                  default: true
                  example: false
                redirectUris:
                  description: Redirect URIs. Each must be an https URL, an http loopback URL (localhost, 127.0.0.1, [::1]), or a private-use scheme URI (e.g. com.example.app:/oauth), and must not contain a fragment.
                  type: array
                  default: []
                  items:
                    type: string
                postLogoutRedirectUris:
                  description: Post-logout redirect URIs for OpenID Connect RP-Initiated Logout. Each must be an https URL, an http loopback URL, or a private-use scheme URI, and must not contain a fragment. After ending the user session, the logout endpoint only redirects to URIs in this list.
                  type: array
                  default: []
                  items:
                    type: string
                type:
                  description: OAuth2 client type. Use `public` for SPAs, mobile, and native apps that cannot keep a `client_secret` — PKCE is then required at the token endpoint. Use `confidential` for server-side clients that present a `client_secret`. Defaults to `confidential`.
                  type: string
                  default: confidential
                  example: public
                deviceFlow:
                  description: Allow this client to use the OAuth2 Device Authorization Grant (RFC 8628) for input-constrained devices such as TVs and CLIs. Defaults to false.
                  type: boolean
                  default: false
                  example: false
                installationScopes:
                  description: Scopes the application requests when installed on a team. Only scopes allowed by the project's OAuth2 server installation scopes configuration are accepted; use the list installation scopes endpoint to discover available values. Maximum of 100 scopes are allowed.
                  type: array
                  default: []
                  items:
                    type: string
                installationRedirectUrl:
                  description: URL users are redirected to after creating or updating an installation of this application. Must be an https URL, an http loopback URL (localhost, 127.0.0.1, [::1]), or a private-use scheme URI, and must not contain a fragment. Leave empty for no redirect.
                  type: string
                  default: ''
                  example: https://example.com
                  format: url
              required:
              - name
    delete:
      summary: Delete Application
      operationId: appsDelete
      tags:
      - apps
      description: Delete an application by its unique ID.
      responses:
        '204':
          description: No content
      deprecated: false
      x-appwrite:
        group: apps
        demo: apps/delete.md
        rate-limit: 60
        rate-time: 60
        rate-key: ip:{ip},userId:{userId}
        scope: apps.write
        platforms:
        - console
        - client
        - server
        packaging: false
        public: true
        auth:
          console:
            Project: []
          client:
            Project: []
          server:
            Project: []
            Session: []
      security:
      - Project: []
        Session: []
        Key: []
        JWT: []
      parameters:
      - name: appId
        description: Application unique ID.
        required: true
        schema:
          type: string
          example: <APP_ID>
        in: path
  /apps/{appId}/installations:
    get:
      summary: List Installations
      operationId: appsListInstallations
      tags:
      - apps
      description: List installations of an application. Requires an app key sent in the `X-Appwrite-Key` header alongside the `X-Appwrite-App` header, or a caller with update access to the app.
      responses:
        '200':
          description: App installations list
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/appInstallationList'
      deprecated: false
      x-appwrite:
        group: installations
        demo: apps/list-installations.md
        rate-limit: 120
        rate-time: 60
        rate-key: ip:{ip}
        scope:
        - apps.read
        - apps.installations.read
        platforms:
        - console
        - client
        - server
        packaging: false
        public: true
        auth:
          console:
            Project: []
          client:
            Project: []
          server:
            Project: []
            Session: []
      security:
      - Project: []
        Session: []
        Key: []
        JWT: []
      parameters:
      - name: appId
        description: Application unique ID.
        required: true
        schema:
          type: string
          example: <APP_ID>
        in: path
      - name: queries
        description: Array of query strings generated using the Query class provided by the SDK. [Learn more about queries](https://appwrite.io/docs/queries). Maximum of 100 queries are allowed, each 4096 characters long.
        required: false
        schema:
          type: array
          items:
            type: string
          default: []
        in: query
      - name: total
        description: When set to false, the total count returned will be 0 and will not be calculated.
        required: false
        schema:
          type: boolean
          example: false
          default: true
        in: query
  /apps/{appId}/installations/{installationId}:
    get:
      summary: Get Installation
      operationId: appsGetInstallation
      tags:
      - apps
      description: Get an installation of an application by its unique ID. Requires an app key sent in the `X-Appwrite-Key` header alongside the `X-Appwrite-App` header, or a caller with update access to the app.
      responses:
        '200':
          description: AppInstallation
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/appInstallation'
      deprecated: false
      x-appwrite:
        group: installations
        demo: apps/get-installation.md
        rate-limit: 120
        rate-time: 60
        rate-key: ip:{ip}
        scope:
        - apps.read
        - apps.installations.read
        platforms:
        - console
        - client
        - server
        packaging: false
        public: true
        auth:
          console:
            Project: []
          client:
            Project: []
          server:
            Project: []
            Session: []
      security:
      - Project: []
        Session: []
        Key: []
        JWT: []
      parameters:
      - name: appId
        description: Application unique ID.
        required: true
        schema:
          type: string
          example: <APP_ID>
        in: path
      - name: installationId
        description: Installation unique ID.
        required: true
        schema:
          type: string
          example: <INSTALLATION_ID>
        in: path
    delete:
      summary: Delete Installation
      operationId: appsDeleteInstallation
      tags:
      - apps
      description: Delete an installation of an application by its unique ID. Requires a caller with update access to the app. Previously issued installation access tokens are revoked.
      responses:
        '204':
          description: No content
      deprecated: false
      x-appwrite:
        group: installations
        demo: apps/delete-installation.md
        rate-limit: 60
        rate-time: 60
        rate-key: ip:{ip},userId:{userId}
        scope: apps.write
        platforms:
        - console
        - client
        - server
        packaging: false
        public: true
        auth:
          console:
            Project: []
          client:
            Project: []
          server:
            Project: []
            Session: []
      security:
      - Project: []
        Session: []
        Key: []
        JWT: []
      parameters:
      - name: appId
        description: Application unique ID.
        required: true
        schema:
          type: string
          example: <APP_ID>
        in: path
      - name: installationId
        description: Installation unique ID.
        required: true
        schema:
          type: string
          example: <INSTALLATION_ID>
        in: path
  /apps/{appId}/installations/{installationId}/tokens:
    post:
      summary: Create Installation Token
      operationId: appsCreateInstallationToken
      tags:
      - apps
      description: 'Create a token for an installation of an application. Requires an app key sent in the `X-Appwrite-Key` header alongside the `X-Appwrite-App` header, or a caller with update access to the app. The returned token carries the scopes and authorization details granted to the installation, and can be used as an `Authorization: Bearer` header everywhere OAuth2 access tokens are accepted. Multiple tokens can be active for the same installation at once; each token stays valid until it expires or the installation is updated or deleted.'
      responses:
        '201':
          description: OAuth2 Token
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/oauth2Token'
      deprecated: false
      x-appwrite:
        group: installations
        demo: apps/create-installation-token.md
        rate-limit: 60
        rate-time: 60
        rate-key: ip:{ip}
        scope:
        - apps.write
        - apps.tokens.write
        platforms:
        - console
        - client
        - server
        packaging: false
        public: true
        auth:
          console:
            Project: []
          client:
            Project: []
          server:
            Project: []
            Session: []
      security:
      - Project: []
        Session: []
        Key: []
        JWT: []
      parameters:
      - name: appId
        description: Application unique ID.
        required: true
        schema:
          type: string
          example: <APP_ID>
        in: path
      - name: installationId
        description: Installation unique ID.
        required: true
        schema:
          type: string
          example: <INSTALLATION_ID>
        in: path
  /apps/{appId}/keys:
    get:
      summary: List App Keys
      operationId: appsListKeys
      tags:
      - apps
      description: List app keys for an application.
      responses:
        '200':
          description: App keys list
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/appKeyList'
      deprecated: false
      x-appwrite:
        group: keys
        demo: apps/list-keys.md
        rate-limit: 120
        rate-time: 60
        rate-key: ip:{ip},userId:{userId}
        scope: apps.read
        platforms:
        - console
        - client
        - server
        packaging: false
        public: true
        auth:
          console:
            Project: []
          client:
            Project: []
          server:
            Project: []
            Session: []
      security:
      - Project: []
        Session: []
        Key: []
        JWT: []
      parameters:
      - name: appId
        description: Application unique ID.
        required: true
        schema:
          type: string
          example: <APP_ID>
        in: path
      - name: queries
        description: Array of query strings generated using the Query class provided by the SDK. [Learn more about queries](https://appwrite.io/docs/queries). Maximum of 100 queries are allowed, each 4096 characters long.
        required: false
        schema:
          type: array
          items:
            type: string
          default: []
        in: query
      - name: total
        description: When set to false, the total count returned will be 0 and will not be calculated.
        required: false
        schema:
          type: boolean
          example: false
          default: true
        in: query
    post:
      summary: Create App Key
      operationId: appsCreateKey
      tags:
      - apps
      description: Create a new app key for an application. App keys carry no scopes; send one in the `X-Appwrite-Key` header alongside the `X-Appwrite-App` header to list the application's installations and create installation access tokens.
      responses:
        '201':
          description: AppKey
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/appKey'
      deprecated: false
      x-appwrite:
        group: keys
        demo: apps/create-key.md
        rate-limit: 60
        rate-time: 60
        rate-key: ip:{ip},userId:{userId}
        scope: apps.write
        platforms:
        - console
        - client
        - server
        packaging: false
        public: true
        auth:
          console:
            Project: []
          client:
            Project: []
          server:
            Project: []
            Session: []
      security:
      - Project: []
        Session: []
        Key: []
        JWT: []
      parameters:
      - name: appId
        description: Application unique ID.
        required: true
        schema:
          type: string
          example: <APP_ID>
        in: path
  /apps/{appId}/keys/{keyId}:
    get:
      summary: Get App Key
      operationId: appsGetKey
      tags:
      - apps
      description: Get an app key by its unique ID.
      responses:
        '200':
          description: AppKey
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/appKey'
      deprecated: false
      x-appwrite:
        group: keys
        demo: apps/get-key.md
        rate-limit: 120
        rate-time: 60
        rate-key: ip:{ip},userId:{userId}
        scope: apps.read
        platforms:
        - console
        - client
        - server
        packaging: false
        public: true
        auth:
          console:
            Project: []
          client:
            Project: []
          server:
            Project: []
            Session: []
      security:
      - Project: []
        Session: []
        Key: []
        JWT: []
      parameters:
      - name: appId
        description: Application unique ID.
        required: true
        schema:
          type: string
          example: <APP_ID>
        in: path
      - name: keyId
        description: App key unique ID.
        required: true
        schema:
          type: string
          example: <KEY_ID>
        in: path
    delete:
      summary: Delete App Key
      operationId: appsDeleteKey
      tags:
      - apps
      description: Delete an app key by its unique ID.
      responses:
        '204':
          description: No content
      deprecated: false
      x-appwrite:
        group: keys
        demo: apps/delete-key.md
        rate-limit: 60
        rate-time: 60
        rate-key: ip:{ip},userId:{userId}
        scope: apps.write
        platforms:
        - console
        - client
        - server
        packaging: false
        public: true
        auth:
          console:
            Project: []
          client:
            Project: []
          server:
            Project: []
            Session: []
      security:
      - Project: []
        Session: []
        Key: []
        JWT: []
      parameters:
      - name: appId
        description: Application unique ID.
        required: true
        schema:
          type: string
          example: <APP_ID>
        in: path
      - name: keyId
        description: App key unique ID.
        required: true
        schema:
          type: string
          example: <KEY_ID>
        in: path
  /apps/{appId}/labels:
    put:
      summary: Update Application Labels
      operationId: appsUpdateLabels
      tags:
      - apps
      description: Update the labels of an application. Labels are read-only for clients; only a server SDK using a project API key can set them. Replaces the previous labels.
      responses:
        '200':
          description: App
   

# --- truncated at 32 KB (62 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/appwrite/refs/heads/main/openapi/appwrite-apps-api-openapi.yml