---
title: "Get flags for a company"
method: GET
path: "/apps/{appId}/envs/{envId}/companies/{companyId}/flags"
---

# Get flags for a company

`GET /apps/{appId}/envs/{envId}/companies/{companyId}/flags`

## Request

- Base URL: `https://app.reflag.com/api`
- URL: `https://app.reflag.com/api/apps/{appId}/envs/{envId}/companies/{companyId}/flags`
- Auth: HTTP bearer

Retrieve flags evaluated with current runtime rules and the company's stored attributes. value is the evaluated enabled state, not a default or the last SDK result. specificTargetValue is saved assignment metadata and can remain true while No one makes value false. No user or other/request context is supplied; stored attributes may differ from a live SDK request.

## Path parameters

- `appId` string, required: App identifier
- `envId` string, required: Environment identifier
- `companyId` string, required: Company ID within your application

## Response `200`

Requested resource retrieved successfully

- EntityFlagsResponse: Response containing flags for an entity
  - `data` EntityFlag[], required: List of flags with their enabled status
    - `id` string, required: Flag ID
    - `key` string, required: Unique flag key
    - `name` string, required: Flag name
    - `createdAt` string, required: Timestamp when the flag was created
    - `value` boolean, required: Evaluated enabled state using current runtime rules and stored entity attributes, not the last SDK result or a default value. Company checks supply only company context. User checks supply user context and also check each stored company membership; no other/request context is supplied. Stored attributes and context may differ from a live SDK request.
    - `specificTargetValue` boolean, nullable, required: Saved explicit assignment, or null if absent. May be true while value is false when targeting is No one. This is configuration metadata, not an effective-access override.
    - `firstExposureAt` string, nullable, required: First time the entity was exposed to this flag
    - `lastExposureAt` string, nullable, required: Last time the entity was exposed to this flag
    - `lastCheckAt` string, nullable, required: Last time the flag was checked for this entity
    - `exposureCount` integer, required: Number of times the entity was exposed to this flag
    - `firstTrackAt` string, nullable, required: First time a track event was recorded for this flag
    - `lastTrackAt` string, nullable, required: Last time a track event was recorded for this flag
    - `trackCount` integer, required: Number of track events for this flag
  - `totalCount` integer, required: Total number of flags
  - `pageSize` integer, required: Page size
  - `pageIndex` integer, required: Page index

## Other responses

- `400`: Bad Request
- `401`: Unauthorized
- `403`: Forbidden
- `404`: Requested resource, or its parent, not found

## Changes

- **2026-11-06** `280aaed4e96e`: 6 breaking, 6 info
  - the response property `data/items/firstExposureAt` became nullable for the status `200`
  - the response property `data/items/firstTrackAt` became nullable for the status `200`
  - the response property `data/items/lastCheckAt` became nullable for the status `200`
  - the response property `data/items/lastExposureAt` became nullable for the status `200`
  - …8 more
- **2026-09-11** `168d14804058`: 1 warning
  - for the `path` request parameter `companyId`, the maxLength was set to `128`

[Operation history](https://skmtc.dev/reflag/apis/reflag-management-api/changes/apps/:appId/envs/:envId/companies/:companyId/flags/get.md)

---

[API](https://skmtc.dev/reflag/apis/reflag-management-api.md) - [All operations](https://skmtc.dev/reflag/apis/reflag-management-api/llms.txt) - [OpenAPI document](https://skmtc.dev/reflag/apis/reflag-management-api/revisions/280aaed4e96e?raw)