# List an app's installations

> The apps.installations operation: GET /api/v1/apps/{id}/installations in the REST API and the apps_installations tool in the MCP server.

For the publisher of a registered app: the organizations that installed it, newest first (at most 100), with
the scopes they granted and the installation's status. Each API call the app makes names one of them with
`Ownrecord-Org` when its token covers several.

## At a glance

- **REST:** `GET /api/v1/apps/{id}/installations`
- **MCP tool:** `apps_installations`
- **Operation ID:** `apps.installations`
- **Scope:** Organization
- **Permission:** `agents:read`
- **Risk tier:** `read`
- **Dry run:** Not supported
- **Idempotency:** Not needed (read only)
- **Modes:** Test and live
- **Authentication:** API key with the `agents:read` scope
- **Since:** M10

## Request

### Path parameters

| Field | Type       | Description |
| ----- | ---------- | ----------- |
| `id`  | `ocl_…` ID |             |

### Query parameters

This operation takes no query parameters.

## Response

`200 OK` with a JSON object:

| Field              | Type                                                                                               | Description |
| ------------------ | -------------------------------------------------------------------------------------------------- | ----------- |
| `object`           | `"list"`                                                                                           |             |
| `data`             | array of object                                                                                    |             |
| `data[].id`        | `ains_…` ID                                                                                        |             |
| `data[].orgId`     | `org_…` ID                                                                                         |             |
| `data[].orgName`   | string                                                                                             |             |
| `data[].scopes`    | array of one of 84 values, e.g. `org:read`, `org:write`, `org:admin` (all in the OpenAPI document) |             |
| `data[].status`    | one of `active`, `paused`, `revoked`                                                               |             |
| `data[].createdAt` | string                                                                                             |             |
| `data[].updatedAt` | string                                                                                             |             |

## Examples

### Where an app is installed

```http
GET /api/v1/apps/ocl_01m4ttwd3veh9apbewxheq5xha/installations
Authorization: Bearer or_test_…
```

Response (`200`):

```json
{
  "object": "list",
  "data": [
    {
      "id": "ains_01m4ttwd3veh9apbewxheq5xhc",
      "orgId": "org_01m4ttwd3veh9apbewxheq5xh3",
      "orgName": "Acme",
      "scopes": ["filings:read", "filings:write", "tasks:read", "tasks:write"],
      "status": "active",
      "createdAt": "2026-10-25T09:00:00.000Z",
      "updatedAt": "2026-10-25T09:00:00.000Z"
    }
  ]
}
```

## Errors

| Code                                                                                     | HTTP status | When                                              | What to do                                                                                           |
| ---------------------------------------------------------------------------------------- | ----------- | ------------------------------------------------- | ---------------------------------------------------------------------------------------------------- |
| [`resource_not_found`](https://ownrecord.io/docs/reference/errors.md#resource_not_found) | 404         | Your organization registered no app with this ID. | Check the ID and that your credentials are scoped to the right organization, entity, brand and mode. |
| [`permission_denied`](https://ownrecord.io/docs/reference/errors.md#permission_denied)   | 403         | You can't see the organization's apps.            | Ask an organization owner or admin for a role or scope that allows this action.                      |

It can also return these [common errors](https://ownrecord.io/docs/reference.md#common-errors): [`validation_failed`](https://ownrecord.io/docs/reference/errors.md#validation_failed), [`api_version_unsupported`](https://ownrecord.io/docs/reference/errors.md#api_version_unsupported), [`authentication_required`](https://ownrecord.io/docs/reference/errors.md#authentication_required), [`api_key_invalid`](https://ownrecord.io/docs/reference/errors.md#api_key_invalid), [`dry_run_not_supported`](https://ownrecord.io/docs/reference/errors.md#dry_run_not_supported), [`rate_limited`](https://ownrecord.io/docs/reference/errors.md#rate_limited), [`internal_error`](https://ownrecord.io/docs/reference/errors.md#internal_error).