List the apps a project can install

get/v1/tenants/{tenant_id}/apps

Requires an API key

The project's team's active apps and every first_party app (Ivora's own), each with its active install here. Anyone with access to the project. A first_party app of another team is shown without its secret_prefix, created_by or webhook_url.

Path parameters

tenant_idintegerRequired

Returns · 200

dataarray of ProjectAppRequired
Child attributes
- appAppRecordRequired
  Child attributes
  - idstringRequired
  - team_idstringRequired
  - namestringRequired
  - descriptionstring | nullRequired
  - icon_urlstring | nullRequired
  - ui_originsarray of stringRequired
  - extensionsarray of objectRequired
  - scopesarray of stringRequired
    The scopes the app requests; an install holds the part its installer consented to.
  - webhook_urlstring | nullRequired
    Null for a first_party app read from another team's project.
  - revisionintegerRequired
    Counts the changes to the app's scopes, origins and extensions. A consent is valid only for the revision it was given on.
  - visibilityenumRequired
    private: only the owning team's projects can install it. first_party: Ivora's own app, installable by every project and shown as made by Ivora; only Ivora administrators set it (403 otherwise).
    One of private, first_party
  - publisherstring | null
    Ivora for a first_party app, which the dashboard shows as made by Ivora; null: the team that registered it.
  - statusenumRequired
    One of active, archived
  - checkout_servicebooleanRequired
    Whether Ivora trusts the app's backend to name the driver's IP address (X-Ivora-Driver-Address) on payment creation, so the 30-a-minute per-address limit counts per driver: honoured only on a client_credentials token of an install holding billing:write, never on a session or exchanged token. Only Ivora administrators set it (403 otherwise), on an app that requests billing:write.
  - secret_prefixstring | nullRequired
    The client secret's first characters, to recognise it; the secret is shown only when it is created or rotated. Null for a first_party app read from another team's project.
  - secret_rotated_atstring | nullRequired
  - created_bystring | nullRequired
    Null for a first_party app read from another team's project.
  - created_atstringRequired
  - updated_atstringRequired
  - installsinteger | null
    Active installs, in the team's projects.
- installobject | nullRequired
  Child attributes
  - idstringRequired
  - app_idstringRequired
  - app_namestring | null
  - tenant_idintegerRequired
  - scopesarray of stringRequired
    What the app holds in this project: its consented scopes, never more than the app requests.
  - consent_revisionintegerRequired
  - rate_limit_per_minuteintegerRequired
  - statusenumRequired
    One of active, revoked
  - installed_bystringRequired
  - installed_atstringRequired
  - updated_atstringRequired
  - revoked_atstring | nullRequired
  - revoked_bystring | nullRequired
  - revoked_reasonstring | nullRequired
    uninstalled or app_archived.
  - staff_reasonstring | null
    Set when Ivora staff installed the app on the project's request: why. Null for an install by the project's own team.

Errors

401 Unauthorized 403 Forbidden 404 Not found 409 Conflict 422 Invalid request 429 Rate limited 502 Upstream error 503 Unavailable

GET /v1/tenants/{tenant_id}/apps

curl --fail-with-body "https://api.ivoracharge.com/v1/tenants/1042/apps" \
  -H "Authorization: Bearer $IVORA_API_KEY"

Response · 200JSON

{
  "data": [
    {
      "app": {
        "id": "id_0123456789abcdef",
        "team_id": "team_0123456789abcdef",
        "name": "bay-01",
        "description": "string",
        "icon_url": "https://app.example.com/return",
        "ui_origins": [
          "string"
        ],
        "extensions": [
          {}
        ],
        "scopes": [
          "string"
        ],
        "webhook_url": "https://app.example.com/return",
        "revision": 1,
        "visibility": "private",
        "publisher": "Ivora",
        "status": "active",
        "checkout_service": false,
        "secret_prefix": "string",
        "secret_rotated_at": "2026-09-30T17:00:00Z",
        "created_by": "string",
        "created_at": "2026-09-30T17:00:00Z",
        "updated_at": "2026-09-30T17:00:00Z",
        "installs": 1
      },
      "install": {
        "id": "id_0123456789abcdef",
        "app_id": "app_0123456789abcdef",
        "app_name": "string",
        "tenant_id": 1042,
        "scopes": [
          "string"
        ],
        "consent_revision": 1,
        "rate_limit_per_minute": 1,
        "status": "active",
        "installed_by": "string",
        "installed_at": "2026-09-30T17:00:00Z",
        "updated_at": "2026-09-30T17:00:00Z",
        "revoked_at": "2026-09-30T17:00:00Z",
        "revoked_by": "string",
        "revoked_reason": "string",
        "staff_reason": "string"
      }
    }
  ]
}

Requires an approved production API keyProduction access starts with a request, a short meeting with Ivora and a card on file, after which Ivora staff grant your account access. How to request access

Try itproduction · api.ivoracharge.com

Production API key iv_live_…

Paste a production api key (iv_live_…). Create keys in Developer tools. The key stays in this page's memory, is sent only to https://api.ivoracharge.com and clears when you reload. Test keys are refused.

tenant_idpath · required