For AI agents: markdown of this page — /docs-content-en/applications/list.md documentation index — /llms.txt

List applications

GET /v1/applications

Returns the applications in the Bitrix24 account that the key owner can see — their own, those shared by colleagues, or both. Results are paginated, and each item has the same fields as an application card.

Parameters

Parameter Type Required Default Description
scope (query) string no feed Which applications to return: mine — your own, shared — other people's applications you can access, feed — both together. Values are case-sensitive. An empty scope= returns 400 INVALID_SCOPE, as does an unknown value; either omit the parameter or set it to one of the three values
page (query) number no 1 Page number, starting from 1. Values below 1 and non-numeric values are treated as 1
limit (query) number no 50 How many applications per page, at most 100. A larger value is clamped to 100; 0 and a non-numeric value fall back to 50; a negative value becomes 1

To paginate, use total, page and limit from the response: request pages sequentially until the number of rows collected reaches total. A page beyond the end of the result set returns 200 with an empty data array rather than an error.

Calculate the page count from total / limit only when truncated is false. When it is true, total is not a complete count and there are no further feed pages; retrieve the remaining applications through mine and shared, which are uncapped.

Examples

curl — personal key

Terminal
curl -H "X-Api-Key: YOUR_API_KEY" \
  "https://vibecode.bitrix24.com/v1/applications?scope=mine&limit=20"

curl — OAuth application

Terminal
curl -H "X-Api-Key: YOUR_APP_KEY" \
  -H "Authorization: Bearer USER_SESSION_TOKEN" \
  "https://vibecode.bitrix24.com/v1/applications?scope=mine&limit=20"

JavaScript — personal key

javascript
const res = await fetch('https://vibecode.bitrix24.com/v1/applications?scope=mine&limit=20', {
  headers: { 'X-Api-Key': 'YOUR_API_KEY' },
})
const { data: applications, total } = await res.json()

applications.forEach(app => {
  const state = app.activeOperation
    ? `${app.activeOperation.kind} — ${app.activeOperation.status}`
    : app.server?.status ?? 'no server'
  console.log(`${app.name}: ${state}`)
})
console.log(`Showing ${applications.length} of ${total}`)

JavaScript — OAuth application

javascript
const res = await fetch('https://vibecode.bitrix24.com/v1/applications?scope=mine&limit=20', {
  headers: {
    'X-Api-Key': 'YOUR_APP_KEY',
    'Authorization': 'Bearer USER_SESSION_TOKEN',
  },
})
const { data: applications, total } = await res.json()

Response fields

Field Type Description
success boolean Always true on success
data array Array of applications. Each array item has the same shape as the data object returned for a single application; its fields are described on the Application card page
total number How many applications matched the requested scope. On feed, this is the size of the result set rather than the number of applications in the Bitrix24 account — read truncated before using it to calculate the page count
page number Returned page number, already normalized to an allowed value
limit number Returned page size, already normalized to an allowed value
truncated boolean Whether the result set was truncated. This field is always present for every scope. If false, total is exact. If true, total is the size of the result set rather than the complete count, and there are no pages beyond it

Response example

JSON
{
  "success": true,
  "data": [
    {
      "id": "cmsw806qp0001tdskzf6mitka",
      "name": "Draft with no server",
      "description": null,
      "type": "PERSONAL",
      "iconUrl": null,
      "createdAt": "2026-08-16T19:51:18.817Z",
      "updatedAt": "2026-08-16T19:51:18.817Z",
      "viewerState": "owner",
      "pinned": false,
      "author": { "name": "Application author" },
      "isEmbedded": true,
      "openUrl": null,
      "openTarget": null,
      "server": null,
      "sources": { "hasVersions": false, "latestVersionId": null, "latestSavedAt": null },
      "activeOperation": null
    },
    {
      "id": "cmsw806qi0000tdskiw2aegii",
      "name": "Deal report",
      "description": "Pipeline summary for the period",
      "type": "PERSONAL",
      "iconUrl": null,
      "createdAt": "2026-08-16T19:51:18.810Z",
      "updatedAt": "2026-08-16T19:51:18.810Z",
      "viewerState": "owner",
      "pinned": false,
      "author": { "name": "Application author" },
      "isEmbedded": false,
      "openUrl": "https://app-05b67cf7.vibecode.bitrix24.com",
      "openTarget": "app",
      "server": {
        "id": "5cbb50f9-f95f-4ddf-ba3b-b771209cb6fb",
        "status": "RUNNING",
        "url": "https://app-05b67cf7.vibecode.bitrix24.com",
        "kind": "STANDALONE",
        "reachable": true,
        "lastDeployedAt": "2026-08-16T19:50:41.302Z"
      },
      "sources": {
        "hasVersions": true,
        "latestVersionId": "v2",
        "latestSavedAt": "2026-08-16T19:41:18.818Z"
      },
      "activeOperation": {
        "kind": "deploy",
        "status": "running",
        "step": "build",
        "startedAt": "2026-08-16T19:50:33.822Z"
      }
    }
  ],
  "total": 2,
  "page": 1,
  "limit": 50,
  "truncated": false
}

Error response example

400 — the scope value is outside the allowed set:

JSON
{
  "success": false,
  "error": {
    "code": "INVALID_SCOPE",
    "message": "scope must be one of: mine, shared, feed"
  }
}

Errors

HTTP Code Description
400 INVALID_SCOPE The scope value is not one of mine, shared, feed. An empty value or different letter case produces the same error
401 NO_PORTAL The key is not linked to a portal — this is the actual response for that case
403 MANAGEMENT_KEY_NO_ENTITY_ACCESS A management key cannot access this endpoint; use an API key or an authorization key
403 PORTAL_KEY_REQUIRED Endpoint safeguard: a malformed key record with no owner. A regular key with no portal returns 401 NO_PORTAL instead
401 MISSING_API_KEY The X-Api-Key header was not sent
401 INVALID_API_KEY The key is not recognized — no such key exists on the platform
429 RATE_LIMITED Rate limit exceeded. The platform-wide limit is 60 requests per minute. The effective limit for your key is returned in the x-ratelimit-limit header. It is lower than the platform-wide limit because that limit is divided across replicas. The counter is per key owner. The limit is stricter than the one for the application card: the list is intended for refreshing a screen, not polling in a loop. The Retry-After header specifies the delay in whole seconds
429 QUOTA_EXCEEDED The key's daily free-call quota is exhausted. Same status, different cause: waiting does not help

The error.message text is always English and intended for logs. Build user-facing messages from error.code. See Errors for the full list of common API errors.

Known specifics

  • The result set is determined by the key owner, not the key itself. Applications created in your Vibecode account are also included: their servers are linked to other keys owned by the same person, so they do not appear in GET /v1/infra/servers but do appear here. The reverse is also true — replace the key with a new one and the same list is returned.
  • Row order depends on scope and is fully deterministic. On feed, pinned applications come first, followed by your own applications and then those shared with you; within each group, applications with a newer updatedAt come first. mine and shared use a single order: createdAt descending. In both cases, id breaks timestamp ties. This matters during pagination: applications created in a batch can have identical timestamps, and without the secondary key, pages in the same traversal could overlap or skip an application.
  • The feed result set has an upper limit, indicated by truncated. The service computes the order for this list before pagination rather than relying on the database query, so it paginates only after sorting. Accordingly, total reports the size of the capped result set, not the total number of applications in the Bitrix24 account. Interpret the flag carefully: it is set when the result set reaches the cap, and a single request cannot distinguish truncation from a result set that contains exactly that many applications. The platform therefore errs on the side of reporting possible truncation. You can identify a false positive by requesting the next page and receiving an empty result. A false negative would be impossible to detect, so the platform does not allow one. On mine and shared, there is no upper limit, total is the complete number of rows matching the filter, and truncated is always false.
  • updatedAt does not indicate code freshness. The field changes when the application card itself changes: after a rename, a description change, or unlinking a deleted server. Deployments do not update it, so an application deployed ten times today may still appear near the end of feed. Use sources.latestSavedAt to determine code freshness.
  • On shared and feed, the source summary is almost always empty. Both enrichment blocks are populated only for users who manage the application, so for other people's applications, sources is empty and activeOperation is null. The row shape does not change, so the row alone cannot distinguish undisclosed data from an application with no versions. A screen that displays code status for the entire result set must account for this.
  • An empty shared result is a valid state, not an error. A 200 response with an empty data array and total: 0 means that no applications owned by other people are available to you. No error occurred.
  • requestable is never returned in the list, regardless of scope. The result set includes only applications that you own, can access through the server's access policy, have been shared with you directly, are linked to a server whose development team you belong to, or have no server and are open to the whole Bitrix24 account. Therefore, this section needs no "Request access" button, and there is nowhere to link one because the endpoint exposes no write operations. The requestable value exists for completeness and appears only when access to the application card is denied: a direct request for someone else's private application returns 403 FORBIDDEN.
  • scope and viewerState use different boundaries. Besides applications shared with you directly, shared also includes applications with no server that are open to the whole Bitrix24 account; such a row has viewerState: "usable", not "shared". A client that filters rows by viewerState === "shared" will omit part of the result set.

See also