One app's listing

GET 
/marketplace/apps/:slug

A partner app's listing, built from one version's manifest (the live one, else the version this workspace's install consented to), or the listing of an app built into KudosCRM — the same shape, partner-only fields null or empty. Everything a person reads is derived: never and the scope rows come from the consent screen's generator, {app} is filled in every text, and every manifest URL is absolute https or null.

install is this workspace's state and the card's button (install.cta), so a listing never needs the grid; can_install / blocked_reason answer for this person: \{App\} is not available right now (suspended), Install it from \{app\}'s site (no install page), Installing apps needs integration management access.

A slug that is neither listed nor installed here is 404 — an unlisted app's key never confirms it exists. Session (or a personal access token) with integrations.read. Throttle: marketplace/read/minute, 120 a minute.

Request

Responses

200

The listing.

401

No session or token, or one that is no longer valid. A request that presented a token gets WWW-Authenticate: Bearer realm="KudosCRM", error="invalid_token" (refresh it); one with no credentials and no session cookie gets the bare challenge.

Response Headers

WWW-Authenticate
Example: Bearer realm="KudosCRM", error="invalid_token"

403

Not allowed: the permission this route needs is missing, the Integrations module is off (code: module_disabled, meta.module_key, meta.blocked_at_layer), or the caller is an app's own OAuth token (code: resource_not_grantable).

404

Not found in this workspace — or not something the caller may know exists.

429

A throttle refused the request. Wait Retry-After seconds — the time left in the refusing window plus 0–3 s of jitter. The X-RateLimit-* headers describe the bucket that refused it.

Response Headers

Retry-After
X-RateLimit-Limit
X-RateLimit-Remaining
X-RateLimit-Reset

Seconds until the window rolls.