## List applications `GET /v1/applications` Returns the applications in the Bitrix24 account that the key owner can see — their own, those shared by colleagues, or both. Results are paginated, and each item has the same fields as an application card. ## Parameters | Parameter | Type | Required | Default | Description | |-----------|------|:----:|---------|-------------| | `scope` (query) | string | no | `feed` | Which applications to return: `mine` — your own, `shared` — other people's applications you can access, `feed` — both together. Values are case-sensitive. An empty `scope=` returns `400 INVALID_SCOPE`, as does an unknown value; either omit the parameter or set it to one of the three values | | `page` (query) | number | no | `1` | Page number, starting from `1`. Values below `1` and non-numeric values are treated as `1` | | `limit` (query) | number | no | `50` | How many applications per page, at most `100`. A larger value is clamped to `100`; `0` and a non-numeric value fall back to `50`; a negative value becomes `1` | To paginate, use `total`, `page` and `limit` from the response: request pages sequentially until the number of rows collected reaches `total`. A page beyond the end of the result set returns `200` with an empty `data` array rather than an error. Calculate the page count from `total / limit` only when `truncated` is `false`. When it is `true`, `total` is not a complete count and there are no further `feed` pages; retrieve the remaining applications through `mine` and `shared`, which are uncapped. ## Examples ### curl — personal key ```bash curl -H "X-Api-Key: YOUR_API_KEY" \ "https://vibecode.bitrix24.com/v1/applications?scope=mine&limit=20" ``` ### curl — OAuth application ```bash curl -H "X-Api-Key: YOUR_APP_KEY" \ -H "Authorization: Bearer USER_SESSION_TOKEN" \ "https://vibecode.bitrix24.com/v1/applications?scope=mine&limit=20" ``` ### JavaScript — personal key ```javascript const res = await fetch('https://vibecode.bitrix24.com/v1/applications?scope=mine&limit=20', { headers: { 'X-Api-Key': 'YOUR_API_KEY' }, }) const { data: applications, total } = await res.json() applications.forEach(app => { const state = app.activeOperation ? `${app.activeOperation.kind} — ${app.activeOperation.status}` : app.server?.status ?? 'no server' console.log(`${app.name}: ${state}`) }) console.log(`Showing ${applications.length} of ${total}`) ``` ### JavaScript — OAuth application ```javascript const res = await fetch('https://vibecode.bitrix24.com/v1/applications?scope=mine&limit=20', { headers: { 'X-Api-Key': 'YOUR_APP_KEY', 'Authorization': 'Bearer USER_SESSION_TOKEN', }, }) const { data: applications, total } = await res.json() ``` ## Response fields | Field | Type | Description | |-------|------|-------------| | `success` | boolean | Always `true` on success | | `data` | array | Array of applications. Each array item has the same shape as the `data` object returned for a single application; its fields are described on the [Application card](./get.md) page | | `total` | number | How many applications matched the requested `scope`. On `feed`, this is the size of the result set rather than the number of applications in the Bitrix24 account — read `truncated` before using it to calculate the page count | | `page` | number | Returned page number, already normalized to an allowed value | | `limit` | number | Returned page size, already normalized to an allowed value | | `truncated` | boolean | Whether the result set was truncated. This field is always present for every `scope`. If `false`, `total` is exact. If `true`, `total` is the size of the result set rather than the complete count, and there are no pages beyond it | ## Response example ```json { "success": true, "data": [ { "id": "cmsw806qp0001tdskzf6mitka", "name": "Draft with no server", "description": null, "type": "PERSONAL", "iconUrl": null, "createdAt": "2026-08-16T19:51:18.817Z", "updatedAt": "2026-08-16T19:51:18.817Z", "viewerState": "owner", "pinned": false, "author": { "name": "Application author" }, "isEmbedded": true, "openUrl": null, "openTarget": null, "server": null, "sources": { "hasVersions": false, "latestVersionId": null, "latestSavedAt": null }, "activeOperation": null }, { "id": "cmsw806qi0000tdskiw2aegii", "name": "Deal report", "description": "Pipeline summary for the period", "type": "PERSONAL", "iconUrl": null, "createdAt": "2026-08-16T19:51:18.810Z", "updatedAt": "2026-08-16T19:51:18.810Z", "viewerState": "owner", "pinned": false, "author": { "name": "Application author" }, "isEmbedded": false, "openUrl": "https://app-05b67cf7.vibecode.bitrix24.com", "openTarget": "app", "server": { "id": "5cbb50f9-f95f-4ddf-ba3b-b771209cb6fb", "status": "RUNNING", "url": "https://app-05b67cf7.vibecode.bitrix24.com", "kind": "STANDALONE", "reachable": true, "lastDeployedAt": "2026-08-16T19:50:41.302Z" }, "sources": { "hasVersions": true, "latestVersionId": "v2", "latestSavedAt": "2026-08-16T19:41:18.818Z" }, "activeOperation": { "kind": "deploy", "status": "running", "step": "build", "startedAt": "2026-08-16T19:50:33.822Z" } } ], "total": 2, "page": 1, "limit": 50, "truncated": false } ``` ## Error response example 400 — the `scope` value is outside the allowed set: ```json { "success": false, "error": { "code": "INVALID_SCOPE", "message": "scope must be one of: mine, shared, feed" } } ``` ## Errors | HTTP | Code | Description | |------|------|-------------| | 400 | `INVALID_SCOPE` | The `scope` value is not one of `mine`, `shared`, `feed`. An empty value or different letter case produces the same error | | 401 | `NO_PORTAL` | The key is not linked to a portal — this is the actual response for that case | | 403 | `MANAGEMENT_KEY_NO_ENTITY_ACCESS` | A management key cannot access this endpoint; use an API key or an authorization key | | 403 | `PORTAL_KEY_REQUIRED` | Endpoint safeguard: a malformed key record with no owner. A regular key with no portal returns `401 NO_PORTAL` instead | | 401 | `MISSING_API_KEY` | The `X-Api-Key` header was not sent | | 401 | `INVALID_API_KEY` | The key is not recognized — no such key exists on the platform | | 429 | `RATE_LIMITED` | Rate limit exceeded. The platform-wide limit is 60 requests per minute. The effective limit for your key is returned in the `x-ratelimit-limit` header. The counter is per key owner. The limit is stricter than the one for the application card: the list is intended for refreshing a screen, not polling in a loop. The `Retry-After` header specifies the delay in whole seconds | | 429 | `QUOTA_EXCEEDED` | The key's daily free-call quota is exhausted. Same status, different cause: waiting does not help | The `error.message` text is always English and intended for logs. Build user-facing messages from `error.code`. See [Errors](/docs/errors) for the full list of common API errors. ## Known specifics - **The result set is determined by the key owner, not the key itself.** Applications created in your Vibecode account are also included: their servers are linked to other keys owned by the same person, so they do not appear in [`GET /v1/infra/servers`](/docs/infra/servers/list) but do appear here. The reverse is also true — replace the key with a new one and the same list is returned. - **Row order depends on `scope` and is fully deterministic.** On `feed`, pinned applications come first, followed by your own applications and then those shared with you; within each group, applications with a newer `updatedAt` come first. `mine` and `shared` use a single order: `createdAt` descending. In both cases, `id` breaks timestamp ties. This matters during pagination: applications created in a batch can have identical timestamps, and without the secondary key, pages in the same traversal could overlap or skip an application. - **The `feed` result set has an upper limit, indicated by `truncated`.** The service computes the order for this list before pagination rather than relying on the database query, so it paginates only after sorting. Accordingly, `total` reports the size of the capped result set, not the total number of applications in the Bitrix24 account. Interpret the flag carefully: it is set when the result set reaches the cap, and a single request cannot distinguish truncation from a result set that contains exactly that many applications. The platform therefore errs on the side of reporting possible truncation. You can identify a false positive by requesting the next page and receiving an empty result. A false negative would be impossible to detect, so the platform does not allow one. On `mine` and `shared`, there is no upper limit, `total` is the complete number of rows matching the filter, and `truncated` is always `false`. - **`updatedAt` does not indicate code freshness.** The field changes when the application card itself changes: after a rename, a description change, or unlinking a deleted server. Deployments do not update it, so an application deployed ten times today may still appear near the end of `feed`. Use `sources.latestSavedAt` to determine code freshness. - **On `shared` and `feed`, the source summary is almost always empty.** Both enrichment blocks are populated only for users who manage the application, so for other people's applications, `sources` is empty and `activeOperation` is `null`. The row shape does not change, so the row alone cannot distinguish undisclosed data from an application with no versions. A screen that displays code status for the entire result set must account for this. - **An empty `shared` result is a valid state, not an error.** A `200` response with an empty `data` array and `total: 0` means that no applications owned by other people are available to you. No error occurred. - **`requestable` is never returned in the list, regardless of `scope`.** The result set includes only applications that you own, can access through the server's access policy, have been shared with you directly, are linked to a server whose development team you belong to, or have no server and are open to the whole Bitrix24 account or to your department. Therefore, this section needs no "Request access" button, and there is nowhere to link one because the endpoint exposes no write operations. The `requestable` value exists for completeness and appears only when access to the application card is denied: a direct request for someone else's private application returns `403 FORBIDDEN`. - **`scope` and `viewerState` use different boundaries.** Besides applications shared with you directly, `shared` also includes applications with no server that are open to the whole Bitrix24 account; such a row has `viewerState: "usable"`, not `"shared"`. A client that filters rows by `viewerState === "shared"` will omit part of the result set. ## See also - [Application card](./get.md) - [Application catalog](/docs/applications) - [Servers](/docs/infra/servers) - [Keys and authorization](/docs/keys-auth) - [Limits and optimization](/docs/optimization) - [Errors](/docs/errors)