---
title: "Install an app"
method: POST
path: "/api/orgs/{slug}/installations"
tags: ["Apps"]
---

# Install an app

`POST /api/orgs/{slug}/installations`

## Request

- Base URL: `https://git.cafe`
- URL: `https://git.cafe/api/orgs/{slug}/installations`
- Auth: one of:
  - API key in cookie `gc-session`
  - HTTP bearer
  - HTTP basic
  - HTTP token

Installs the exact app revision the administrator approved for all of the organization's repositories (current and future) or the selected ones, creating its bot principal for this organization. It approves the organization's pending requests for the app and returns the manifest's setup URL, with the installation ID, the organization and the install link's `state`. Requires authenticated authority and enforces current resource policy.

## Path parameters

- `slug` string, required

## Request body

- object
  - `appId` string, required
  - `revision` integer, required
  - `manifestHash` string, required
  - `repositorySelection` 'all' | 'selected'
  - `repositories` string[]
  - `state` string

## Response `201`

Response for status 201

- object
  - `id` string, required
  - `appId` string, required
  - `app` string, required
  - `name` string, required
  - `publisher` string, required
  - `iconUrl` string, nullable, required
  - `org` string, required
  - `bot` object, required
    - `actorId` string, required
    - `handle` string, required
    - `assignable` boolean, required
    - `mentionable` boolean, required
  - `revision` integer, required
  - `latestRevision` integer, required
  - `version` integer, required
  - `repositorySelection` 'all' | 'selected', required
  - `repositories` string[], required
  - `permissions` object[], required
    - `kind` 'repo' | 'branch' | 'pr' | 'issue' | 'comment' | 'org' | 'team', required
    - `family` string, required
    - `level` 'read' | 'write' | 'admin', required
  - `user` object, required
    - `permissions` object[], required
      - `kind` 'repo' | 'branch' | 'pr' | 'issue' | 'comment' | 'org' | 'team', required
      - `family` string, required
      - `level` 'read' | 'write' | 'admin', required
    - `audiences` string[], required
  - `pausedAt` string, nullable, required
  - `suspendedAt` string, nullable, required
  - `uninstalledAt` string, nullable, required
  - `installedAt` string, required
  - `installedBy` object, nullable, required
    - `handle` string, required
    - `displayName` string, nullable, required
    - `avatarUrl` string, nullable, required
  - `lastUsedAt` string, nullable, required
  - `setupUrl` string, nullable, required

## Other responses

- `400`: The request is invalid.
- `401`: Authentication is required, or the supplied credential is invalid.
- `403`: The credential does not permit this operation. A `code`, when present, names the refusal.
- `404`: The resource does not exist or is not visible to the caller.
- `409`: The request conflicts with the current state. A `code`, when present, names the refusal; `retryable` says whether the same request can succeed later, and `operationId` names the operation in the way.
- `429`: A rate limit is exhausted. Wait Retry-After seconds; the value is a hint, so back off on a repeat 429.
- `503`: A required service is temporarily unavailable; retry later.

---

[API](https://skmtc.dev/gitcafe/apis/git-cafe-api.md) - [All operations](https://skmtc.dev/gitcafe/apis/git-cafe-api/llms.txt) - [OpenAPI document](https://skmtc.dev/gitcafe/apis/git-cafe-api/revisions/9fa233d2986d?raw)