Skip to content

API reference

Installed apps

The apps installed on a device, as the device last reported them.

Each device reports its own app inventory, so the list is only as current as the device’s last report. There is no per-app timestamp. Android, Apple and Windows devices report different details, and fields a platform does not report are null.

On Android, the list also contains apps that the device’s policy requires but that failed to install (installed: false). Use them to spot failed deployments.

The installed app object

object
string
Always installed_app.
identifier
string
Android package name, Apple bundle id, Windows Store package family name, or MSI/EXE product code (falls back to the display name).
name
stringnullable
Display name. null when the platform does not report it. Android user apps report only the package name.
type
stringnullable
How the app reached the device. store: installed from Google Play, the App Store or the Microsoft Store. Apple apps are store only when the device reports them as App Store apps. private: distributed privately. This covers Android private apps, Apple apps not from the App Store, and sideloaded Windows packages. system: bundled with the OS, such as Android pre-installed apps and Windows system packages. Returned only with includeSystem=true. msi / exe: Windows desktop apps. null: a Windows package whose origin the device has not reported yet. These apps are returned only when no type filter is sent.
One ofstoreprivatesystemmsiexe
version
stringnullable
Display version.
versionCode
stringnullable
Android version code. Always null on other platforms.
installed
boolean
false for an app that the device’s policy requires but that failed to install (Android). See error for details. Otherwise true.
publisher
stringnullable
Publisher of Windows desktop (msi / exe) apps.
sizeBytes
integernullable
App size in bytes (Apple). null when the device does not report it.
installedAt
timestampnullable
Install date (Windows), when the device reports one that can be read. Devices usually report a local date without a time. The API returns it as that date at T00:00:00Z.
status
stringnullable
Install state of Windows msi / exe apps, as reported by the device.
error
objectnullable
Install failure details reported by the platform, for an Android policy app that failed to install or a Windows msi / exe app with a non-zero error code. Otherwise null.
error.code
stringnullable
Platform-specific failure code, as reported. For information only.
error.message
stringnullable
Human-readable failure description, as reported.
Example (windows)
{
  "object": "installed_app",
  "identifier": "{8A69D345-D564-463C-AFF1-A69D9E530F96}",
  "name": "Google Chrome",
  "type": "msi",
  "version": "126.0.6478.127",
  "versionCode": null,
  "installed": true,
  "publisher": "Google LLC",
  "sizeBytes": null,
  "installedAt": "2026-08-21T00:00:00Z",
  "status": "Installed",
  "error": null
}

List a device’s installed apps

GET/v1/devices/{deviceId}/apps
Requiresapps:read

Returns the apps installed on the device, plus apps its policy requires that failed to install (installed: false). This list is not paginated. The whole inventory comes back in one list object, with hasMore always false and nextCursor always null. Items are sorted by name, then identifier, case-insensitively, with missing names last.

Path parameters

deviceId
stringrequired
Id of the device. Case-insensitive.

Query parameters

type
stringoptionaldefault all types
Only return apps of these types. Pass a comma-separated list, for example store,private. Values are case-insensitive. Sending this filter leaves out apps whose type is null. system also needs includeSystem=true. Without it, system matches nothing.
One or more ofstoreprivatesystemmsiexe
includeSystem
booleanoptionaldefault false
Set to true to also return apps bundled with the OS (type system): Android pre-installed apps and Windows system packages.

Example request

curl "https://api-gw.weguard.ai/core/v1/devices/6523f1c2a7b9d40012345678/apps?type=store,private" \
  -H "Authorization: Bearer $WEGUARD_API_KEY"

Response

A list object whose data holds every matching installed app object.

200 OK
{
  "object": "list",
  "data": [
    {
      "object": "installed_app",
      "identifier": "com.acme.scanner",
      "name": null,
      "type": "private",
      "version": "3.2.0",
      "versionCode": "320",
      "installed": false,
      "publisher": null,
      "sizeBytes": null,
      "installedAt": null,
      "status": null,
      "error": {
        "code": "NOT_COMPATIBLE_WITH_DEVICE",
        "message": "The app is not compatible with this device."
      }
    },
    {
      "object": "installed_app",
      "identifier": "com.android.chrome",
      "name": null,
      "type": "store",
      "version": "126.0.6478.71",
      "versionCode": "647807131",
      "installed": true,
      "publisher": null,
      "sizeBytes": null,
      "installedAt": null,
      "status": null,
      "error": null
    }
  ],
  "hasMore": false,
  "nextCursor": null
}

Errors

  • No device with this id exists in your account.

  • type contains an unsupported value, includeSystem is not true/false, or a parameter was sent twice.

  • The request includes another query parameter. This endpoint is not paginated, so it rejects limit and cursor too.

  • The key lacks apps:read.

Common errors

Besides the errors listed for each endpoint, any request can fail authentication, exceed the rate limit, ask for a format other than JSON, or fail with a server error. See Errors for the response format and retry guidance.

  • The request has no Authorization header.

  • The Authorization header does not use the Bearer scheme, or has no key after it. The WWW-Authenticate header carries error="invalid_request".

  • The key is malformed, does not exist, or its secret does not match. The WWW-Authenticate header carries error="invalid_token".

  • The key is past its expiresAt.

  • An account admin revoked the key. Revocation takes effect immediately and cannot be undone.

  • The WeGuard account that owns the key has been deleted or disabled.

  • The Accept header excludes JSON.

  • The key has used up its request budget. See Rate limits.

  • An unexpected error occurred on our side.

  • A service WeGuard depends on is temporarily unavailable, or reading the data took longer than the time WeGuard allows for it. This can also happen while your key is being checked, so it can be returned before authentication completes. The response carries Retry-After.

We use cookies

We use cookies to ensure you get the best experience on our website. For more information on how we use cookies, please see our cookie policy.

By clicking "Accept", you agree to our use of cookies.

Learn more