API reference
Installed apps
The apps installed on a device, as the device last reported them.
Each device reports its own app inventory, so the list is only as current as the device’s last report. There is no per-app timestamp. Android, Apple and Windows devices report different details, and fields a platform does not report are null.
On Android, the list also contains apps that the device’s policy requires but that failed to install (installed: false). Use them to spot failed deployments.
The installed app object
objectstring- Always
installed_app. identifierstring- Android package name, Apple bundle id, Windows Store package family name, or MSI/EXE product code (falls back to the display name).
namestringnullable- Display name.
nullwhen the platform does not report it. Android user apps report only the package name. typestringnullable- How the app reached the device.
store: installed from Google Play, the App Store or the Microsoft Store. Apple apps arestoreonly when the device reports them as App Store apps.private: distributed privately. This covers Android private apps, Apple apps not from the App Store, and sideloaded Windows packages.system: bundled with the OS, such as Android pre-installed apps and Windows system packages. Returned only withincludeSystem=true.msi/exe: Windows desktop apps.null: a Windows package whose origin the device has not reported yet. These apps are returned only when notypefilter is sent.One ofstoreprivatesystemmsiexe versionstringnullable- Display version.
versionCodestringnullable- Android version code. Always
nullon other platforms. installedbooleanfalsefor an app that the device’s policy requires but that failed to install (Android). Seeerrorfor details. Otherwisetrue.publisherstringnullable- Publisher of Windows desktop (
msi/exe) apps. sizeBytesintegernullable- App size in bytes (Apple).
nullwhen the device does not report it. installedAttimestampnullable- Install date (Windows), when the device reports one that can be read. Devices usually report a local date without a time. The API returns it as that date at
T00:00:00Z. statusstringnullable- Install state of Windows
msi/exeapps, as reported by the device. errorobjectnullable- Install failure details reported by the platform, for an Android policy app that failed to install or a Windows
msi/exeapp with a non-zero error code. Otherwisenull. error.codestringnullable- Platform-specific failure code, as reported. For information only.
error.messagestringnullable- Human-readable failure description, as reported.
{
"object": "installed_app",
"identifier": "{8A69D345-D564-463C-AFF1-A69D9E530F96}",
"name": "Google Chrome",
"type": "msi",
"version": "126.0.6478.127",
"versionCode": null,
"installed": true,
"publisher": "Google LLC",
"sizeBytes": null,
"installedAt": "2026-08-21T00:00:00Z",
"status": "Installed",
"error": null
}List a device’s installed apps
/ v1/ devices/ {deviceId}/ appsReturns the apps installed on the device, plus apps its policy requires that failed to install (installed: false). This list is not paginated. The whole inventory comes back in one list object, with hasMore always false and nextCursor always null. Items are sorted by name, then identifier, case-insensitively, with missing names last.
Path parameters
deviceIdstringrequired- Id of the device. Case-insensitive.
Query parameters
typestringoptionaldefault all types- Only return apps of these types. Pass a comma-separated list, for example
store,private. Values are case-insensitive. Sending this filter leaves out apps whosetypeisnull.systemalso needsincludeSystem=true. Without it,systemmatches nothing.One or more ofstoreprivatesystemmsiexe includeSystembooleanoptionaldefault false- Set to
trueto also return apps bundled with the OS (typesystem): Android pre-installed apps and Windows system packages.
Example request
curl "https://api-gw.weguard.ai/core/v1/devices/6523f1c2a7b9d40012345678/apps?type=store,private" \
-H "Authorization: Bearer $WEGUARD_API_KEY"const response = await fetch("https://api-gw.weguard.ai/core/v1/devices/6523f1c2a7b9d40012345678/apps?type=store,private", {
headers: { Authorization: `Bearer ${process.env.WEGUARD_API_KEY}` },
});
const body = await response.json();
if (!response.ok) {
throw new Error(`${body.code}: ${body.detail} (requestId ${body.requestId})`);
}
console.log(body);import os
import requests
response = requests.get(
"https://api-gw.weguard.ai/core/v1/devices/6523f1c2a7b9d40012345678/apps",
params={"type": "store,private"},
headers={"Authorization": f"Bearer {os.environ['WEGUARD_API_KEY']}"},
timeout=30,
)
response.raise_for_status()
print(response.json())Response
A list object whose data holds every matching installed app object.
{
"object": "list",
"data": [
{
"object": "installed_app",
"identifier": "com.acme.scanner",
"name": null,
"type": "private",
"version": "3.2.0",
"versionCode": "320",
"installed": false,
"publisher": null,
"sizeBytes": null,
"installedAt": null,
"status": null,
"error": {
"code": "NOT_COMPATIBLE_WITH_DEVICE",
"message": "The app is not compatible with this device."
}
},
{
"object": "installed_app",
"identifier": "com.android.chrome",
"name": null,
"type": "store",
"version": "126.0.6478.71",
"versionCode": "647807131",
"installed": true,
"publisher": null,
"sizeBytes": null,
"installedAt": null,
"status": null,
"error": null
}
],
"hasMore": false,
"nextCursor": null
}Errors
No device with this id exists in your account.
typecontains an unsupported value,includeSystemis nottrue/false, or a parameter was sent twice.The request includes another query parameter. This endpoint is not paginated, so it rejects
limitandcursortoo.The key lacks
apps:read.
Common errors
Besides the errors listed for each endpoint, any request can fail authentication, exceed the rate limit, ask for a format other than JSON, or fail with a server error. See Errors for the response format and retry guidance.
The request has no
Authorizationheader.The
Authorizationheader does not use theBearerscheme, or has no key after it. TheWWW-Authenticateheader carrieserror="invalid_request".The key is malformed, does not exist, or its secret does not match. The
WWW-Authenticateheader carrieserror="invalid_token".The key is past its
expiresAt.An account admin revoked the key. Revocation takes effect immediately and cannot be undone.
The WeGuard account that owns the key has been deleted or disabled.
The
Acceptheader excludes JSON.The key has used up its request budget. See Rate limits.
An unexpected error occurred on our side.
A service WeGuard depends on is temporarily unavailable, or reading the data took longer than the time WeGuard allows for it. This can also happen while your key is being checked, so it can be returned before authentication completes. The response carries
Retry-After.