The marketplace grid
GET/marketplace/apps
Every app this workspace can see — partner apps first (listed apps of a publisher in good standing, plus any app installed here whatever its listing), then the 19 apps built into KudosCRM in catalog order — each with its state and button from one state table, so a card and the listing page never disagree:
| app | condition | state · state_label | cta |
|---|---|---|---|
| partner | no install | available · Available | Install → the partner's install page (external); none, with a reason, when it has none |
| partner | connecting, or setup not finished | installed · Connecting / Setup incomplete | Finish setup → the setup page |
| partner | active | connected · Active | Manage |
| partner | paused (checked first) | attention · Paused | Resume → Manage |
| partner | reauth_required | attention · Reconnect needed | Reconnect → the install page (else Manage) |
| built into KudosCRM | connected | connected · Active | Manage |
| built into KudosCRM | needs reauth / errored | attention · Reconnect needed / Failing | Reconnect |
| built into KudosCRM | not connected | available · Available | Connect |
| built into KudosCRM | coming soon | coming_soon · Coming soon | Soon |
meta.counts.connected counts installed-but-not-set-up apps too; meta.categories gives the
rail's order and labels only (the screen counts after its own filters); meta.featured is the
most recently listed featured app, or null. Every in-app link carries workspace=<tenant uuid>.
Session (or a personal access token) with integrations.read, the Integrations module on.
Throttle: marketplace/read/minute, 120 a minute.
Responses
- 200
- 401
- 403
- 429
The grid.
No session or token, or one that is no longer valid. A request that presented a token gets
WWW-Authenticate: Bearer realm="KudosCRM", error="invalid_token" (refresh it); one with no
credentials and no session cookie gets the bare challenge.
Response Headers
Bearer realm="KudosCRM", error="invalid_token"Not allowed: the permission this route needs is missing, the Integrations module is off
(code: module_disabled, meta.module_key, meta.blocked_at_layer), or the caller is an app's
own OAuth token (code: resource_not_grantable).
A throttle refused the request. Wait Retry-After seconds — the time left in the refusing window
plus 0–3 s of jitter. The X-RateLimit-* headers describe the bucket that refused it.
Response Headers
Seconds until the window rolls.