---
title: "Lists the customers holding relations on one app, one cursor page at a time."
method: GET
path: "/authorization/relations/external-app"
tags: ["ExternalApps"]
---

# Lists the customers holding relations on one app, one cursor page at a time.

`GET /authorization/relations/external-app`

app is required: each app is a separate object in the graph, so there is no combined
 listing. Returns every relation unless relation narrows it. Follow nextCursor to page.

## Query parameters

- `app` 'ArgoCd' | 'Grafana', required — The third-party applications that federate on our OIDC `groups` claim and can therefore be administered through a grant here. Each maps to an `external_app` object in the authorization graph. A closed enum rather than a free-form id on purpose: an arbitrary string would let a typo write a grant against an object nothing consumes, which looks like access was granted but silently is not. Adding an app is a value here plus a tuple — no model change.This is the app itself; the relation vocabulary defined on these objects is AuthorizationRelations.ExternalApp. The Id suffix here keeps the two distinguishable: a file with using static AuthorizationRelations imports that nested enum, and identical short names would make every bare mention ambiguous.
- `relation` 'Admin' | 'Viewer' — Relations on an `external_app` object — one object per third-party app that federates on the OIDC `groups` claim. The apps themselves are `ExternalAppId`. The ladder is hierarchical: `admin` folds into `viewer`. Grants are direct and, like `Bidder`, are never folded in from platform staff — holding platform admin must not confer administration of a separate system.
- `cursor` string
- `page_size` integer

## Response `200`

OK

- GetExternalAppRelationMembersEndpointCursorPagedResultOfOutput — A page of results identified by an opaque cursor rather than an offset. Used where the underlying store pages by continuation token and a total count is unavailable or expensive. string? CursorPagedResult<T>.NextCursor is null on the last page.
  - `items` GetExternalAppRelationMembersEndpointOutput[], required
    - `customer` string, uuid, required — The customer holding the relation.
    - `email` string, required — The email address of the customer.
    - `organizationName` string, required — The name of the customer's active organization.
    - `organizationId` string, required — The identifier of the customer's active organization.
    - `scope` 'Platform' | 'Bidder' | 'ExternalApp', required
    - `app` 'ArgoCd' | 'Grafana', required — The third-party applications that federate on our OIDC `groups` claim and can therefore be administered through a grant here. Each maps to an `external_app` object in the authorization graph. A closed enum rather than a free-form id on purpose: an arbitrary string would let a typo write a grant against an object nothing consumes, which looks like access was granted but silently is not. Adding an app is a value here plus a tuple — no model change.This is the app itself; the relation vocabulary defined on these objects is AuthorizationRelations.ExternalApp. The Id suffix here keeps the two distinguishable: a file with using static AuthorizationRelations imports that nested enum, and identical short names would make every bare mention ambiguous.
    - `relation` 'Admin' | 'Viewer', required — Relations on an `external_app` object — one object per third-party app that federates on the OIDC `groups` claim. The apps themselves are `ExternalAppId`. The ladder is hierarchical: `admin` folds into `viewer`. Grants are direct and, like `Bidder`, are never folded in from platform staff — holding platform admin must not confer administration of a separate system.
    - `grantedAt` string, date-time, required — When the grant was written.
  - `nextCursor` string, nullable

## Other responses

- `400` — Bad Request
- `401` — Unauthenticated
- `403` — Forbidden

---

[API](https://skmtc.net/rapidata/apis/rapidata-api.md) · [All operations](https://skmtc.net/rapidata/apis/rapidata-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/rapidata/rapidata-api/revisions/fdb89a6eb2fb/schema)