---
title: "List apps"
method: GET
path: "/user_risk/apps/list"
tags: ["userrisk"]
---

# List apps

`GET /user_risk/apps/list`

## Request

- Base URL: `https://cyber-risk.upguard.com/api/public`
- URL: `https://cyber-risk.upguard.com/api/public/user_risk/apps/list`
- Auth: API key in header `Authorization`
- TypeScript: <https://skmtc.dev/upguard/apis/upguard-cyberrisk-api/docs/user_risk/apps/list/get.ts> (a function with typed inputs; its response is checked against the schema)

Retrieve a list of apps for your organization.

Required API key permissions: `User Risk` (select when creating API key in Account Settings)

## Query parameters

- `page_size` integer
- `page_token` string
- `sort_by` 'name' | 'first_detected' | 'num_users' | 'exposure_level'
- `sort_dir` 'asc' | 'desc'
- `usage_policy_outcomes` string[]
- `usage_policy_sources` string[]
- `categories` string[]
- `sources` string[]
- `shadow_ai` boolean
- `vendor_using_ai` boolean
- `vendor_monitored` boolean
- `first_detected_min` string, date-time
- `first_detected_max` string, date-time

## Response `200`

The list of apps for your organization

- UserRiskAppsListResponse
  - `apps` App[], required: The list of apps.
    - `category` string: The category of the application.
    - `description` string: A description of the application.
    - `domain` string: The domain associated with the application.
    - `exposure_level` 'basic' | 'elevated', string: The risk level associated with the application or permission.
    - `first_detected` string, date-time, required: The date and time the application was first detected.
    - `is_shadow_ai` boolean, required: Indicates whether the application is considered Shadow AI.
    - `metadata` AppMetadata, required
      - `entra_app_id` string: The Microsoft Entra ID (formerly Azure AD) of the application.
    - `name` string, required: The name of the application.
    - `num_current_users` integer, required: The number of users currently using the application.
    - `sources` string[], required: The sources from which the application was detected.
    - `summary` string: A brief summary of the application.
    - `usage_policy` UsagePolicy, required: UsagePolicy describes the app usage policy applied to an application, including the base rule applied by default and any custom rules that override it for specific teams, roles, or users.
      - `base_rule` 'approve' | 'tolerate' | 'nudge' | 'block', string, required: The outcome applied to users by default, unless overridden by a custom rule.
      - `custom_rules` object: Custom rules that override the base rule for specific teams, roles, or users, keyed by the outcome they apply.
      - `source` 'org_default' | 'app' | 'app_category', string, required: Where the application's usage policy is derived from.
    - `vendor_id` integer: The unique identifier of the vendor.
    - `vendor_monitored` boolean: Indicates whether the vendor is being monitored.
    - `vendor_name` string: The name of the vendor associated with the application.
    - `vendor_security_rating` integer: The security rating of the vendor (0-950).
    - `vendor_security_rating_trend` integer: The change in the vendor's security rating in the last 30 days.
    - `vendor_using_ai` boolean: Indicates whether the vendor is known to use AI.
  - `next_page_token` string: The token to be used to retrieve the next page of results. Will not be returned if there are no more results.

## Other responses

- `403`: Your API key does not have permission to perform this action.
- `422`: An invalid parameter was supplied or a mandatory parameter was missing
- `429`: Too many requests have been made to this endpoint.
- `500`: An internal system error occurred

## Changes

- **2026-11-07** `d044bf6dc61e`: 1 warning, 4 info
  - deleted the `query` request parameter `statuses`
  - added the new optional `query` request parameter `sort_by`
  - added the new optional `query` request parameter `sort_dir`
  - added the new optional `query` request parameter `usage_policy_outcomes`
  - …1 more

[Operation history](https://skmtc.dev/upguard/apis/upguard-cyberrisk-api/changes/user_risk/apps/list/get.md)

---

[API](https://skmtc.dev/upguard/apis/upguard-cyberrisk-api.md) - [All operations](https://skmtc.dev/upguard/apis/upguard-cyberrisk-api/llms.txt) - [OpenAPI document](https://skmtc.dev/upguard/apis/upguard-cyberrisk-api/revisions/d044bf6dc61e?raw)