Apps
Team-owned apps that extend the dashboard and act on a project: register an app at /v1/teams/{team_id}/apps (UI origins, extensions, requested scopes, webhook URL, client secret), then install it in a project at /v1/tenants/{tenant_id}/apps/{app_id}/install after its consent view, and uninstall it to revoke everything at once. Apps may hold stations:control, billing:write and tariffs:write with consent and their own per-install rate limit, never billing:refund. Private to the owning team's projects. Changing, archiving or rotating an app, and listing its installs, reach every project it is installed in: a developer limited to some projects does them only while every active install is in one of theirs. Signed-in users only; API keys and connected apps are refused. Not the MCP OAuth connected apps.
16 endpoints
- getList a team's apps/v1/teams/{team_id}/appsAny member of the team and Ivora staff.
- postRegister an app for a team/v1/teams/{team_id}/appsThe team's owners, admins and developers, and Ivora administrators.
- getRead a team's app/v1/teams/{team_id}/apps/{app_id}
- patchChange a team's app/v1/teams/{team_id}/apps/{app_id}Changing the scopes, UI origins or extensions raises the app's revision, so a consent given earlier cannot be reused (409 consent outdated).
- deleteArchive an app and revoke all its installs/v1/teams/{team_id}/apps/{app_id}Every install of the app, in every project, is revoked at once (revoked reason app archived).
- postRotate an app's client secret/v1/teams/{team_id}/apps/{app_id}/secretThe old secret stops working at once; for a first party app only Ivora administrators rotate it (403 app first party staff only); the new one is returned once.
- postIssue an app's webhook signing key/v1/teams/{team_id}/apps/{app_id}/webhook-secretReplaces the key that signs the app's lifecycle events (app.installed, app.uninstalled, app.scopes changed); for a first party app only Ivora administrators issue it (403 app first party staff only); the new one is returned once.
- getList an app's lifecycle events and their delivery/v1/teams/{team_id}/apps/{app_id}/deliveriesOldest first after the after cursor (an event sequence).
- getList an app's installs across the team's projects/v1/teams/{team_id}/apps/{app_id}/installsRevoked installs are included, for a project-limited developer only in their projects, and only when the app is active in none outside them.
- getList the apps a project can install/v1/tenants/{tenant_id}/appsThe project's team's active apps and every first party app (Ivora's own), each with its active install here.
- getRead what installing an app would grant/v1/tenants/{tenant_id}/apps/{app_id}/consentThe consent screen's data: the scopes the app requests (sensitive ones flagged: stations:control, billing:write, tariffs:write, settlement:write), the per-install rate limit and the revision to send back when installing.
- postInstall an app in a project/v1/tenants/{tenant_id}/apps/{app_id}/installA team owner, admin or developer of the project, and Ivora administrators; another team's first party app only the project team's owners and admins (403 for a developer).
- getList a project's app installs/v1/tenants/{tenant_id}/installsActive and revoked installs, oldest first.
- getRead an app install/v1/tenants/{tenant_id}/installs/{install_id}
- patchChange an install's scopes or rate limit/v1/tenants/{tenant_id}/installs/{install_id}Scopes are replaced with a fresh consent (scopes and consent revision).
- deleteUninstall an app/v1/tenants/{tenant_id}/installs/{install_id}A team owner, admin or developer of the project, and Ivora administrators.