Connected apps
GET/app_installs
Everything that can read or write this workspace's data: each partner install (newest first),
then the connections built into KudosCRM, one row per app however many connections it has (two Slack
workspaces are one row; per-person mailboxes are one Gmail row, "3 people"). A partner row's
status is the most actionable of: paused → reauth_required → error (the app or its publisher is
suspended — "Suspended" — or its webhook deliveries stopped — "Failing") → connecting →
setup_incomplete → healthy ("Active").
meta.attention is what needs an admin, most urgent first — a lost connection, then something
failing, then a pause, then a setup nobody finished, then a version waiting for review — the same
list as the nav badge (attention_count) and the settings overview. One person's broken mailbox
is never a banner.
A partner row's last_activity_at and last_activity_label say when the app last reached this
workspace over a working connection, and how: API request (a request its token made, recorded
while the request log is on; a 401, a 503, and any request while the install is paused or the
app or its publisher is suspended do not count) or Event received (an event it sent was accepted
or held at ingest). They move at most once a minute, and stay null until the app's first activity.
integrations.read, the Integrations module on. Throttle: app_installs/read/minute, 300 a minute.
A signed-in session or the person's own personal access token; an app's OAuth token is refused
(403 resource_not_grantable).
Responses
- 200
- 401
- 403
- 429
The rows, what needs attention, and the tallies.
No session or token, or one that is no longer valid. A request that presented a token gets
WWW-Authenticate: Bearer realm="KudosCRM", error="invalid_token" (refresh it); one with no
credentials and no session cookie gets the bare challenge.
Response Headers
Bearer realm="KudosCRM", error="invalid_token"Not allowed: the permission this route needs is missing, the Integrations module is off
(code: module_disabled, meta.module_key, meta.blocked_at_layer), or the caller is an app's
own OAuth token (code: resource_not_grantable).
A throttle refused the request. Wait Retry-After seconds — the time left in the refusing window
plus 0–3 s of jitter. The X-RateLimit-* headers describe the bucket that refused it.
Response Headers
Seconds until the window rolls.