For AI agents: markdown of this page — /docs-content-en/applications/list.md documentation index — /llms.txt
List applications
GET /v1/applications
Returns the applications in the Bitrix24 account that the key owner can see — their own, those shared by colleagues, or both. Results are paginated, and each item has the same fields as an application card.
Parameters
| Parameter | Type | Required | Default | Description |
|---|---|---|---|---|
scope (query) |
string | no | feed |
Which applications to return: mine — your own, shared — other people's applications you can access, feed — both together. Values are case-sensitive. An empty scope= returns 400 INVALID_SCOPE, as does an unknown value; either omit the parameter or set it to one of the three values |
page (query) |
number | no | 1 |
Page number, starting from 1. Values below 1 and non-numeric values are treated as 1 |
limit (query) |
number | no | 50 |
How many applications per page, at most 100. A larger value is clamped to 100; 0 and a non-numeric value fall back to 50; a negative value becomes 1 |
To paginate, use total, page and limit from the response: request pages sequentially until the number of rows collected reaches total. A page beyond the end of the result set returns 200 with an empty data array rather than an error.
Calculate the page count from total / limit only when truncated is false. When it is true, total is not a complete count and there are no further feed pages; retrieve the remaining applications through mine and shared, which are uncapped.
Examples
curl — personal key
curl -H "X-Api-Key: YOUR_API_KEY" \
"https://vibecode.bitrix24.com/v1/applications?scope=mine&limit=20"
curl — OAuth application
curl -H "X-Api-Key: YOUR_APP_KEY" \
-H "Authorization: Bearer USER_SESSION_TOKEN" \
"https://vibecode.bitrix24.com/v1/applications?scope=mine&limit=20"
JavaScript — personal key
const res = await fetch('https://vibecode.bitrix24.com/v1/applications?scope=mine&limit=20', {
headers: { 'X-Api-Key': 'YOUR_API_KEY' },
})
const { data: applications, total } = await res.json()
applications.forEach(app => {
const state = app.activeOperation
? `${app.activeOperation.kind} — ${app.activeOperation.status}`
: app.server?.status ?? 'no server'
console.log(`${app.name}: ${state}`)
})
console.log(`Showing ${applications.length} of ${total}`)
JavaScript — OAuth application
const res = await fetch('https://vibecode.bitrix24.com/v1/applications?scope=mine&limit=20', {
headers: {
'X-Api-Key': 'YOUR_APP_KEY',
'Authorization': 'Bearer USER_SESSION_TOKEN',
},
})
const { data: applications, total } = await res.json()
Response fields
| Field | Type | Description |
|---|---|---|
success |
boolean | Always true on success |
data |
array | Array of applications. Each array item has the same shape as the data object returned for a single application; its fields are described on the Application card page |
total |
number | How many applications matched the requested scope. On feed, this is the size of the result set rather than the number of applications in the Bitrix24 account — read truncated before using it to calculate the page count |
page |
number | Returned page number, already normalized to an allowed value |
limit |
number | Returned page size, already normalized to an allowed value |
truncated |
boolean | Whether the result set was truncated. This field is always present for every scope. If false, total is exact. If true, total is the size of the result set rather than the complete count, and there are no pages beyond it |
Response example
{
"success": true,
"data": [
{
"id": "cmsw806qp0001tdskzf6mitka",
"name": "Draft with no server",
"description": null,
"type": "PERSONAL",
"iconUrl": null,
"createdAt": "2026-08-16T19:51:18.817Z",
"updatedAt": "2026-08-16T19:51:18.817Z",
"viewerState": "owner",
"pinned": false,
"author": { "name": "Application author" },
"isEmbedded": true,
"openUrl": null,
"openTarget": null,
"server": null,
"sources": { "hasVersions": false, "latestVersionId": null, "latestSavedAt": null },
"activeOperation": null
},
{
"id": "cmsw806qi0000tdskiw2aegii",
"name": "Deal report",
"description": "Pipeline summary for the period",
"type": "PERSONAL",
"iconUrl": null,
"createdAt": "2026-08-16T19:51:18.810Z",
"updatedAt": "2026-08-16T19:51:18.810Z",
"viewerState": "owner",
"pinned": false,
"author": { "name": "Application author" },
"isEmbedded": false,
"openUrl": "https://app-05b67cf7.vibecode.bitrix24.com",
"openTarget": "app",
"server": {
"id": "5cbb50f9-f95f-4ddf-ba3b-b771209cb6fb",
"status": "RUNNING",
"url": "https://app-05b67cf7.vibecode.bitrix24.com",
"kind": "STANDALONE",
"reachable": true,
"lastDeployedAt": "2026-08-16T19:50:41.302Z"
},
"sources": {
"hasVersions": true,
"latestVersionId": "v2",
"latestSavedAt": "2026-08-16T19:41:18.818Z"
},
"activeOperation": {
"kind": "deploy",
"status": "running",
"step": "build",
"startedAt": "2026-08-16T19:50:33.822Z"
}
}
],
"total": 2,
"page": 1,
"limit": 50,
"truncated": false
}
Error response example
400 — the scope value is outside the allowed set:
{
"success": false,
"error": {
"code": "INVALID_SCOPE",
"message": "scope must be one of: mine, shared, feed"
}
}
Errors
| HTTP | Code | Description |
|---|---|---|
| 400 | INVALID_SCOPE |
The scope value is not one of mine, shared, feed. An empty value or different letter case produces the same error |
| 401 | NO_PORTAL |
The key is not linked to a portal — this is the actual response for that case |
| 403 | MANAGEMENT_KEY_NO_ENTITY_ACCESS |
A management key cannot access this endpoint; use an API key or an authorization key |
| 403 | PORTAL_KEY_REQUIRED |
Endpoint safeguard: a malformed key record with no owner. A regular key with no portal returns 401 NO_PORTAL instead |
| 401 | MISSING_API_KEY |
The X-Api-Key header was not sent |
| 401 | INVALID_API_KEY |
The key is not recognized — no such key exists on the platform |
| 429 | RATE_LIMITED |
Rate limit exceeded. The platform-wide limit is 60 requests per minute. The effective limit for your key is returned in the x-ratelimit-limit header. It is lower than the platform-wide limit because that limit is divided across replicas. The counter is per key owner. The limit is stricter than the one for the application card: the list is intended for refreshing a screen, not polling in a loop. The Retry-After header specifies the delay in whole seconds |
| 429 | QUOTA_EXCEEDED |
The key's daily free-call quota is exhausted. Same status, different cause: waiting does not help |
The error.message text is always English and intended for logs. Build user-facing messages from error.code. See Errors for the full list of common API errors.
Known specifics
- The result set is determined by the key owner, not the key itself. Applications created in your Vibecode account are also included: their servers are linked to other keys owned by the same person, so they do not appear in
GET /v1/infra/serversbut do appear here. The reverse is also true — replace the key with a new one and the same list is returned. - Row order depends on
scopeand is fully deterministic. Onfeed, pinned applications come first, followed by your own applications and then those shared with you; within each group, applications with a newerupdatedAtcome first.mineandshareduse a single order:createdAtdescending. In both cases,idbreaks timestamp ties. This matters during pagination: applications created in a batch can have identical timestamps, and without the secondary key, pages in the same traversal could overlap or skip an application. - The
feedresult set has an upper limit, indicated bytruncated. The service computes the order for this list before pagination rather than relying on the database query, so it paginates only after sorting. Accordingly,totalreports the size of the capped result set, not the total number of applications in the Bitrix24 account. Interpret the flag carefully: it is set when the result set reaches the cap, and a single request cannot distinguish truncation from a result set that contains exactly that many applications. The platform therefore errs on the side of reporting possible truncation. You can identify a false positive by requesting the next page and receiving an empty result. A false negative would be impossible to detect, so the platform does not allow one. Onmineandshared, there is no upper limit,totalis the complete number of rows matching the filter, andtruncatedis alwaysfalse. updatedAtdoes not indicate code freshness. The field changes when the application card itself changes: after a rename, a description change, or unlinking a deleted server. Deployments do not update it, so an application deployed ten times today may still appear near the end offeed. Usesources.latestSavedAtto determine code freshness.- On
sharedandfeed, the source summary is almost always empty. Both enrichment blocks are populated only for users who manage the application, so for other people's applications,sourcesis empty andactiveOperationisnull. The row shape does not change, so the row alone cannot distinguish undisclosed data from an application with no versions. A screen that displays code status for the entire result set must account for this. - An empty
sharedresult is a valid state, not an error. A200response with an emptydataarray andtotal: 0means that no applications owned by other people are available to you. No error occurred. requestableis never returned in the list, regardless ofscope. The result set includes only applications that you own, can access through the server's access policy, have been shared with you directly, are linked to a server whose development team you belong to, or have no server and are open to the whole Bitrix24 account. Therefore, this section needs no "Request access" button, and there is nowhere to link one because the endpoint exposes no write operations. Therequestablevalue exists for completeness and appears only when access to the application card is denied: a direct request for someone else's private application returns403 FORBIDDEN.scopeandviewerStateuse different boundaries. Besides applications shared with you directly,sharedalso includes applications with no server that are open to the whole Bitrix24 account; such a row hasviewerState: "usable", not"shared". A client that filters rows byviewerState === "shared"will omit part of the result set.