---
title: "App manifest"
method: GET
path: "/v1/apps/{id}"
tags: ["Apps"]
---

# App manifest

`GET /v1/apps/{id}`

## Request

- Base URL: `https://api.talonic.com`
- URL: `https://api.talonic.com/v1/apps/{id}`
- Auth: HTTP bearer

## Path parameters

- `id` string, uuid, required

## Response `200`

Manifest.

- AppManifest: An app as humans and agents both see it (docs/APPS-SPEC.md §B1.2). A `hosted` app's document is discovered at `/.well-known/talonic-app.json` first, then `/manifest.json` (`manifest_path` says which one answered); its `requires[]` slots are referenced elsewhere in the manifest as `$requires.<alias>` and bound to workspace resources at install (`POST .../install` `bindings`).
  - `app_id` string: Stable public id (app_ prefix).
  - `id` string, uuid
  - `slug` string
  - `display_name` string
  - `version` integer, nullable
  - `content_hash` string, nullable
  - `mode` 'rules' | 'assisted' | 'autonomous' | 'external'
  - `enabled` boolean
  - `contract` object, nullable
    - `reads` string[]
    - `acts` string[]
  - `output_contract` object, nullable: JSON Schema 2020-12 the decision validates against.
  - `input_schema` object
  - `triggers` object, nullable
  - `thresholds` object, nullable
  - `fallback` 'rules' | 'hold' | 'none', nullable
  - `endpoints` object
    - `mcp` string
    - `rest` string
    - `surface` string: The installed external service's UI. The one install-derived value a manifest carries - read-only, absent when the app is not installed.
  - `surface` object: How the app's own UI may be hosted, from the ACTIVE version's manifest with the defaults applied (a manifest with no surface block reads as embed link, scopes [apps:read], context []). A draft never changes it.
    - `embed` 'iframe' | 'link': iframe = hosted inside the shell; link = opened in its own tab.
    - `scopes` string[]: OAuth scopes an embedded session carries; a subset of the pre-consentable set (apps:read, apps:operate, records:write, identity:read).
    - `context` string[]: What the shell shares over the handshake (theme, locale, role).
  - `required_grants` object[]: The capability claim an owner approves at install (§B13.1); disclosed BEFORE the service key is minted.
    - `kind` string
    - `id` string: A resource id, `*`, `self`, or `$requires.<alias>`.
    - `access` 'read' | 'act' | 'write'
  - `subscriptions` object[]: Outbox events the active version subscribes to, with the defaults applied.
    - `event` string
    - `match` object
  - `subscriptions_endpoint` string, nullable: Where events are delivered; null when the manifest subscribes to nothing.
  - `source` 'pushed' | 'hosted': pushed = draft + publish; hosted = fetched from manifest_url.
  - `manifest_url` string, nullable
  - `last_fetch_at` string, date-time, nullable
  - `last_fetch_error` string, nullable: Null when the last hosted fetch succeeded; the config page offers Refresh instead of a draft editor while this is set.
  - `identity` AppManifestIdentity: The vendor's self-declared identity block (docs/APPS-SPEC.md §B1.2). Required on a hosted manifest; informational on a pushed one, where the platform's own app row and content hash remain the identity of record.
    - `name` string
    - `display_name` string, nullable
    - `description` string, nullable
    - `version` string, nullable
    - `homepage` string, nullable
    - `icon` string, nullable
  - `requires` AppRequirementSlot[]
    - `alias` string
    - `kind` string: AppResourceType, e.g. data_product, reference_table, source_connection, app, spec, pipeline, document_source, app_run_set, review.
    - `access` 'read' | 'act' | 'write'
    - `purpose` string: One sentence the install disclosure shows.
    - `optional` boolean
    - `scope` 'self': 'self' binds the slot to the app itself - admissible only on a `review` slot (any access) or an `app` slot with access `act` - so it needs no owner choice and never appears in `bindings`.
  - `allowed_origins` string[]: Origins the manifest's host vouches for, beyond the manifest's own origin (the implicit default when empty). A hosted manifest's `subscriptions_endpoint` and `surface.url` must lie inside this set.

## Other responses

- `404`: The requested resource was not found.

---

[API](https://skmtc.dev/talonic/apis/talonic-api.md) · [All operations](https://skmtc.dev/talonic/apis/talonic-api/llms.txt) · [OpenAPI document](https://skmtc.dev/talonic/apis/talonic-api/revisions/678fe5f8c9c3?raw)