API & integrations·Reference

REST API reference

Everything in the AppApex dashboard is available over a JSON REST API. Read your apps, pull recommendations, trigger agent runs, and stream results into your own tools.

Base URL and auth

All requests go to the versioned base URL and authenticate with a bearer token. Create a token in Settings, then API tokens. Tokens are scoped to your workspace - rotate or revoke them any time.

Authenticated requestbash

curl https://app.appapex.io/api/v1/apps \
  -H "Authorization: Bearer $APPAPEX_TOKEN"

Core endpoints

GET /api/v1/apps

List the apps in your workspace. Requires the read:apps scope.

GET /api/v1/recommendations

List recommendations. Filter by app_id, status (pending, viewed, applied, dismissed, expired), agent, and priority (critical, high, medium, low). Requires read:recommendations.

POST /api/v1/agents/{type}/run

Trigger a run for an agent type (conversion, retention, aso, spy, review_intel, ...). Body: { "app_id": "..." }. Requires the admin scope - runs spend AI budget.

GET /api/v1/runs/{id}

Fetch a run's status and the recommendations it produced. Requires read:apps.

Example: list recommendations

bash

curl "https://app.appapex.io/api/v1/recommendations?status=pending&priority=high" \
  -H "Authorization: Bearer $APPAPEX_TOKEN"

Responsejson

{
  "data": [
    {
      "id": "9c1f4e62-...",
      "app_id": "5b2a81d0-...",
      "agent": "conversion",
      "priority": "high",
      "status": "pending",
      "title": "Lead screenshots with the streak feature",
      "estimated_impact": {
        "metric": "trial_conversion_rate",
        "current": 0.041,
        "estimated": 0.052,
        "confidence": "medium"
      },
      "created_at": "2026-06-01T09:30:00.000Z"
    }
  ],
  "has_more": false
}

Versioning and limits

The API is versioned in the path (/v1). Breaking changes ship under a new version.
Rate limit is 120 requests per minute per token; responses include X-RateLimit-Remaining.
Responses are paginated with has_more and a starting_after cursor.

Treat tokens like passwords. They carry full workspace scope - never ship one in a mobile or web client. Rotate immediately in Settings, then API tokens if one leaks.