---
title: "Get one app"
method: GET
path: "/clients/{id_client}/apps/{id_app}"
tags: ["apps"]
---

# Get one app

`GET /clients/{id_client}/apps/{id_app}`

## Request

- Base URL: `https://api.planvortex.com/v1.0.0`
- URL: `https://api.planvortex.com/v1.0.0/clients/{id_client}/apps/{id_app}`
- Auth: one of:
  - HTTP bearer
  - OAuth 2 (client credentials, token URL `https://api.planvortex.com/v1.0.0/oauth/token`)

The app's record, without its secret. Note the envelope: `{client_app}` here, `{client_apps, total}` in the list.

**An app token works here.** This is the one part of `/apps` that does: an app can read and update its own record, but it cannot list, create, delete, or read the secret. **No plan is required**: apps are on all four plans, the free one included.

## Path parameters

- `id_client` string, required
- `id_app` string, required

## Response `200`

The app

- object
  - `client_app` AppsClientApp, required: An app: the credentials a third-party integration authenticates with. **The secret is not here.** It lives in Keycloak and is read with `GET /clients/{id_client}/apps/{id_app}/secret`, which needs a user token.
    - `_id` string, required
    - `id_client` string, required
    - `id_user` string: The user who created the app, when it was created from the panel.
    - `name` string, required
    - `keycloak_client_idenfifier` string, required: The app's `client_id`. Fixed for the life of the app: it cannot be changed once created (error 547).
    - `allowed_domains` string[], required
    - `redirect_urls` string[], required
    - `webhook_url` string: Where PlanVortex posts events, when one is configured. **The body is an array of changes, not a single object**, and it carries two signature headers computed with this app's secret over the **raw** body: `x-hub-signature` (`sha1=<hex>`) and `x-hub-signature-256` (`sha256=<hex>`). Verify against the bytes you received — parsing the JSON and re-serialising it changes them and the signature will not match. The events delivered today are `new_account`, `change_state_account`, `messages`, `messaging_postbacks`, `messaging_seen`, `messaging_error`, `comments`, `integration_error`, `ai_plan_generated` and `ai_plan_failed`. The payload is documented in the `comments` specification. **Every** app of the client that has a `webhook_url` receives every event, not only the app whose call caused it: with two apps, each event arrives twice. Delivery is best effort: PlanVortex does not retry a webhook that fails.
    - `creation_date` string, date-time, required
    - `deleted` boolean, required: Deleting an app marks it instead of removing it — the Keycloak client is gone, so it can no longer get a token — and the listing filters those out.
    - `deleted_date` string, date-time

## Other responses

- `400`: Error. Classify by `code` in the body, never by the HTTP status.

---

[API](https://skmtc.dev/planvortex/apis/planvortex-api.md) · [All operations](https://skmtc.dev/planvortex/apis/planvortex-api/llms.txt) · [OpenAPI document](https://skmtc.dev/planvortex/apis/planvortex-api/revisions/abedbbc1cd52?raw)