# Retrieves all Multitenant Mobile App Identifiers.

`GET /api/configuration/multitenant-mobile-app-identifier`

- **Success:** `200 OK`
- **Products:** Gladstone Admin Areas (`ADMIN`)
- **Features:** not restricted by feature

HTML version: [Retrieves all Multitenant Mobile App Identifiers.](https://support.gladstonesoftware.cloud/reference/configuration/retrieves-all-multitenant-mobile-app-identifiers)

## Overview

Lists the multi-tenant mobile apps the platform knows about — the shared Gladstone apps that several
tenants use, each identified by its store bundle id and its OneSignal application id for push
notifications — and, on request, the released versions of each.

**Ask for versions and you receive their app secrets in plain text.** `versions[].appSecret` is the
credential a build of the app authenticates with, returned in full and readable by anything that can
see the response. Do not log this response, cache it in a browser, or pass it to a client
application: request `includeVersions=false` (the default) unless you specifically need the secrets.

The whole list is returned in one response, with no paging or filtering. Sorting is opt-in via
`appBundleIdSort` and `versionSort`; without them the order is unspecified and is
not guaranteed stable between calls.

## Endpoint

`GET {base_url}/api/configuration/multitenant-mobile-app-identifier`

`{base_url}` is the environment URL issued to your integration. See [Authenticating with Gladstone APIs](../../guides/authenticating-with-gladstone-apis.md).

## Query parameters

| Name | Type | Required | Description |
|------|------|----------|-------------|
| `includeVersions` | boolean | No | Whether to include each app's released versions. **Defaults to `false`**, in which case `versions` comes back as an empty array rather than being omitted. Set it to `true` only when you need version detail, because that also returns each version's `appSecret` in plain text. It must be `true` before `versionSort` may be used. |
| `versionSort` | string | No | Orders the entries inside each app's `versions` array. Accepts only `asc` or `desc`, case-insensitively; anything else fails with `400` and `versionSort must be 'asc' or 'desc'.` Sending it without `includeVersions=true` also fails, with `versionSort can only be used when includeVersions is true.` Ordering is by version number rather than by string, so `1.10.0` sorts above `1.9.0`. Omit it and versions come back in no particular order. |
| `appBundleIdSort` | string | No | Orders the apps themselves by `appBundleId`. Accepts only `asc` or `desc`, case-insensitively; anything else fails with `400` and `appBundleIdSort must be 'asc' or 'desc'.` Unlike `versionSort` it works regardless of `includeVersions`. Omit it and the order is unspecified. |

## Sample request

```bash title="cURL"
curl -X GET '{base_url}/api/configuration/multitenant-mobile-app-identifier' \
  -H 'Authorization: Bearer {accessToken}' \
  -H 'X-Use-SSO: true'
```

## Response fields

| Field | Type | Description |
|-------|------|-------------|
| `[].id` | integer (int32) | The app record's identifier, and the handle for reading or amending a single app. Distinct from the ids inside `versions`, which identify versions. |
| `[].appBundleId` | string | The app's store bundle identifier — the reverse-domain name the app is published under. Always present, maximum 255 characters, and the field `appBundleIdSort` orders on. |
| `[].oneSignalAppId` | string | The app's identifier in OneSignal, the push-notification provider, used to address notifications to installs of this app. Always present, maximum 255 characters. It is an identifier, not a credential — the OneSignal API key is not exposed here. |
| `[].versions` | array of object | The app's released versions. **Empty unless you sent `includeVersions=true`** — an empty array therefore means "not requested" as often as it means "none exist", and the response does not distinguish the two. Ordered by `versionSort` when supplied. |
| `[].versions[].id` | integer (int32) | The version record's identifier, unique across all apps rather than only within this one. |
| `[].versions[].appVersion` | string | The released version number, up to 50 characters and always present. Sorting parses it as a dotted version number, so a value that is not in that form is not ordered meaningfully — do not assume it can always be parsed. |
| `[].versions[].appSecret` | string | **The version's authentication secret, in plain text.** It is a randomly generated value held against the version, up to 512 characters, and it is returned in full every time you ask for versions — unlike an API key, it is not shown once and hidden thereafter. Treat this response as a secret-bearing payload: do not log it, cache it, or expose it to a browser or mobile client. |

## Sample response

```json title="200 OK"
[
  {
    "id": 12345,
    "appBundleId": "string",
    "oneSignalAppId": "string",
    "versions": [
      {
        "id": 12345,
        "appVersion": "string",
        "appSecret": "string"
      }
    ]
  }
]
```

## Errors

| Status | Meaning | When |
|--------|---------|------|
| `400` | Bad request | One of three checks, each returning its message as a plain string body: `versionSort must be 'asc' or 'desc'.`, `appBundleIdSort must be 'asc' or 'desc'.`, or `versionSort can only be used when includeVersions is true.` The sort values are checked before the combination, so fix the spelling before the combination. |
| `500` | Internal server error | Any unexpected server-side failure while reading the identifiers, with an empty body. |