---
title: "Get app API reference"
method: GET
path: "/api/apps/{app_id}/openapi-spec"
---

# Get app API reference

`GET /api/apps/{app_id}/openapi-spec`

## Request

- Base URL: `https://app.base44.com`
- URL: `https://app.base44.com/api/apps/{app_id}/openapi-spec`
- Auth: HTTP bearer

<Info>This API is in beta. Endpoints, fields, and behavior may still change, so avoid depending on it in production.</Info>

Returns a reference for the app's own API, the one its code and other systems use to work with its data. It covers:
- Each entity's endpoints to list, read, create, update, and delete records
- The app's users
- Its backend functions
- Its agents

The reference is built from the app as it is now, so it can include entities and functions that haven't been published yet. Server addresses use the app's `base44.app` address, even when it also has a custom domain.

This is limited to 30 requests a minute per caller for each app. Some workspaces have a different limit.

<Note>This endpoint accepts a personal API key belonging to a user with editor access to the app, including a read-only key. Workspace API keys are not accepted.</Note>

## Path parameters

- `app_id` string, required: ID of the app.

## Response `200`

The app's API reference, as an OpenAPI 3.0.3 document.

- AppOpenApiSpec: An OpenAPI 3.0.3 document describing the app's own API.
  - `openapi` string, required: OpenAPI version of the document.
  - `info` object, required: Title and description of the app's API. The title is the app's name followed by `API`.
  - `servers` object[], required: The app's API address, built from its slug.
  - `paths` object, required: One entry per endpoint of the app's entities, backend functions, and agents.
  - `components` object, required: A schema for each entity, and the `api_key` header the app's API authenticates with.

## Other responses

- `401`: Missing or invalid credentials.
- `403`: You don't have editor access to this app, or you used a workspace API key.
- `404`: App not found.
- `429`: Too many API reference requests for this app from you in the last minute.

## Changes

- **2026-10-13** `32455e516133`: 2 info
  - the security scope `read_only` was added to the endpoint's security scheme `PersonalAccessTokenAuth`
  - the security scope `full_access` was removed from the endpoint's security scheme `PersonalAccessTokenAuth`
- **2026-10-11** `80287813ab84`: 1 info
  - the endpoint scheme security `PersonalAccessTokenAuth` was added to the API
- **2026-09-29** `347e2afcf94a`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/base44/apis/base44-app-management-api/changes/api/apps/:app_id/openapi-spec/get.md)

---

[API](https://skmtc.dev/base44/apis/base44-app-management-api.md) - [All operations](https://skmtc.dev/base44/apis/base44-app-management-api/llms.txt) - [OpenAPI document](https://skmtc.dev/base44/apis/base44-app-management-api/revisions/c534f09cf314?raw)