---
title: "What approving would change (human workspace owner only)"
method: GET
path: "/v1/apps/{id}/install/diff"
tags: ["Apps"]
---

# What approving would change (human workspace owner only)

`GET /v1/apps/{id}/install/diff`

## Request

- Base URL: `https://api.talonic.com`
- URL: `https://api.talonic.com/v1/apps/{id}/install/diff`
- Auth: HTTP bearer

The approved claim next to the pending one — grants and subscriptions added or removed, the surface scopes, requirement slots, vouched origins, identity, and whether the delivery endpoint or the surface URL moved.

## Path parameters

- `id` string, uuid, required

## Query parameters

- `version` integer

## Response `200`

The install diff.

- AppInstallDiff: What `GET .../install/diff` reports - the approved claim next to the pending one, so an owner can see what approving would change.
  - `approved_version` integer, nullable
  - `pending_version` integer, nullable
  - `grants` object
    - `added` object[]
      - `kind` string
      - `id` string
      - `access` string
    - `removed` object[]
      - `kind` string
      - `id` string
      - `access` string
  - `subscriptions` object
    - `added` object[]
      - `event` string
      - `match` object
    - `removed` object[]
      - `event` string
      - `match` object
  - `endpoint` object
    - `from` string, nullable
    - `to` string, nullable
    - `changed` boolean
  - `scopes` object
    - `from` string[]
    - `to` string[]
  - `surface_url` object: Where the manifest frames the app (surface.url). An approval that moves this re-points a hosted install's live surface.
    - `from` string, nullable
    - `to` string, nullable
    - `changed` boolean
  - `slots` object: Requirement slots the pending manifest adds, drops, or keeps.
    - `added` AppRequirementSlot[]
      - `alias` string
      - `kind` string: AppResourceType, e.g. data_product, reference_table, source_connection, app, spec, pipeline, document_source, app_run_set, review.
      - `access` 'read' | 'act' | 'write'
      - `purpose` string: One sentence the install disclosure shows.
      - `optional` boolean
      - `scope` 'self': 'self' binds the slot to the app itself - admissible only on a `review` slot (any access) or an `app` slot with access `act` - so it needs no owner choice and never appears in `bindings`.
    - `removed` AppRequirementSlot[]
      - `alias` string
      - `kind` string: AppResourceType, e.g. data_product, reference_table, source_connection, app, spec, pipeline, document_source, app_run_set, review.
      - `access` 'read' | 'act' | 'write'
      - `purpose` string: One sentence the install disclosure shows.
      - `optional` boolean
      - `scope` 'self': 'self' binds the slot to the app itself - admissible only on a `review` slot (any access) or an `app` slot with access `act` - so it needs no owner choice and never appears in `bindings`.
    - `unchanged` AppRequirementSlot[]
      - `alias` string
      - `kind` string: AppResourceType, e.g. data_product, reference_table, source_connection, app, spec, pipeline, document_source, app_run_set, review.
      - `access` 'read' | 'act' | 'write'
      - `purpose` string: One sentence the install disclosure shows.
      - `optional` boolean
      - `scope` 'self': 'self' binds the slot to the app itself - admissible only on a `review` slot (any access) or an `app` slot with access `act` - so it needs no owner choice and never appears in `bindings`.
  - `allowed_origins` object
    - `from` string[], nullable
    - `to` string[], nullable
  - `identity` object
    - `from` AppManifestIdentity: The vendor's self-declared identity block (docs/APPS-SPEC.md §B1.2). Required on a hosted manifest; informational on a pushed one, where the platform's own app row and content hash remain the identity of record.
      - `name` string
      - `display_name` string, nullable
      - `description` string, nullable
      - `version` string, nullable
      - `homepage` string, nullable
      - `icon` string, nullable
    - `to` AppManifestIdentity: The vendor's self-declared identity block (docs/APPS-SPEC.md §B1.2). Required on a hosted manifest; informational on a pushed one, where the platform's own app row and content hash remain the identity of record.
      - `name` string
      - `display_name` string, nullable
      - `description` string, nullable
      - `version` string, nullable
      - `homepage` string, nullable
      - `icon` string, nullable

## Other responses

- `403`: The API key does not have the required scope.
- `404`: The requested resource was not found.
- `422`: version is not a positive integer.

---

[API](https://skmtc.dev/talonic/apis/talonic-api.md) · [All operations](https://skmtc.dev/talonic/apis/talonic-api/llms.txt) · [OpenAPI document](https://skmtc.dev/talonic/apis/talonic-api/revisions/678fe5f8c9c3?raw)