Frontdoor's HTTP endpoints, their authentication requirements and error format, plus the bulk app API for automation.
Frontdoor exposes a JSON API under /api.
Conventions
- Every error response is JSON with a human-readable
error and a stable snake_case code.
- Requests that change data with the session cookie must come from Frontdoor itself or from an origin listed in
CORS_ALLOWED_ORIGINS.
Authentication levels
| Level |
Meaning |
| No |
Public endpoint |
| Session |
The frontdoor_token cookie, or the same token as Authorization: Bearer |
| Admin viewer |
Session of an owner, admin or admin_readonly |
| Admin editor |
Session of an owner or admin |
| Owner |
Session of an owner |
| API key |
The X-API-Key header with the value of ADMIN_API_KEY |
Bulk app API
The bulk endpoints are meant for CI and automation pipelines that own the app catalog.
| Method |
Endpoint |
Description |
| GET |
/api/apps/bulk |
Export every app with full metadata, active and inactive |
| POST |
/api/apps/bulk |
Create or update apps in one call, matched by slug |
Both require the X-API-Key header and answer 503 when ADMIN_API_KEY is not configured.
curl -s https://frontdoor.contoso.com/api/apps/bulk \
-H 'X-API-Key: your-api-key'
Health and sign-in
| Method |
Endpoint |
Auth |
Description |
| GET |
/api/health |
No |
Health check |
| GET |
/api/auth/microsoft |
No |
Start the Microsoft sign-in (PKCE; optional ?redirect=<app slug>) |
| GET |
/api/auth/microsoft/callback |
No |
Microsoft sign-in callback |
| GET |
/api/auth/me |
Session |
Current user and preferences (impersonation is null, or { sessionId, actor, expiresAt, reason } while acting as a user) |
| PUT |
/api/auth/me/preferences |
Session |
Update own preferences (Home view, language, time zone, theme, app order, favourites, tour) |
| POST |
/api/auth/home-activity |
Session |
Record Home activity (throttled) |
| POST |
/api/auth/logout |
No |
Sign out (clears the cookie) |
| GET |
/api/auth/dev-status |
No |
Whether Dev Login is available |
| POST |
/api/auth/dev-login |
No |
Dev Login (development only, never in production) |
| POST |
/api/auth/verify-sso-token |
Token and audience in the body |
SSO token introspection for satellite apps (see Authentication for satellite apps) |
Impersonation
| Method |
Endpoint |
Auth |
Description |
| POST |
/api/impersonation |
Admin viewer |
Start acting as a user (body { userId, reason }; returns 201 { sessionId, expiresAt }) |
| POST |
/api/impersonation/stop |
Session |
End the impersonation (returns { ok: true }) |
Branding and maintenance
| Method |
Endpoint |
Auth |
Description |
| GET |
/api/branding |
No |
Branding and tenant defaults |
| PUT |
/api/branding |
Owner |
Update branding and tenant defaults |
| GET |
/api/branding/logo |
No |
Company logo |
| GET |
/api/branding/cache |
Owner |
Avatar cache, icon cache and database size |
| POST |
/api/branding/avatars/refresh |
Owner |
Clear the avatar cache |
| POST |
/api/branding/app-icons/cleanup |
Owner |
Remove unused app icon files |
| POST |
/api/branding/database/compact |
Owner |
Compact the database (VACUUM) |
Apps
| Method |
Endpoint |
Auth |
Description |
| GET |
/api/apps |
Session |
Apps visible to the current user |
| GET |
/api/apps/all |
Admin viewer |
All apps, including inactive ones |
| GET |
/api/apps/:id/icon |
No |
App icon |
| GET |
/api/apps/:slug/sso-redirect |
Session |
Open an app (redirect or SSO POST, access logged) |
| GET |
/api/apps/:slug/entra-redirect |
Session |
Open an Entra app through MyApps (access logged) |
| POST |
/api/apps/:slug/track-access |
Session |
Record an access to an app opened directly |
| POST |
/api/apps |
Admin editor |
Create an app |
| POST |
/api/apps/:id/clone |
Admin editor |
Prepare a copy of an app (nothing is saved) |
| PUT |
/api/apps/:id |
Admin editor |
Update an app (only changed fields are written) |
| POST |
/api/apps/:id/groups |
Admin editor |
Set the groups that can open an app |
| DELETE |
/api/apps/:id |
Admin editor |
Delete an app |
| POST |
/api/apps/restore-defaults |
Admin editor |
Restore the demo apps |
| GET |
/api/apps/bulk |
API key |
Bulk export apps (full metadata) |
| POST |
/api/apps/bulk |
API key |
Bulk upsert apps by slug |
Users
| Method |
Endpoint |
Auth |
Description |
| GET |
/api/users |
Admin viewer |
List users |
| GET |
/api/users/:id |
Admin viewer |
User detail (groups, visible apps) |
| GET |
/api/users/:id/avatar |
Session |
User avatar |
| PUT |
/api/users/:id/preferences |
Admin editor |
Update or reset a user's preferences |
| PUT |
/api/users/:id/role |
Admin editor |
Change role |
| PUT |
/api/users/:id/active |
Admin editor |
Activate or deactivate |
| DELETE |
/api/users/:id |
Admin editor |
Delete a user |
Groups
| Method |
Endpoint |
Auth |
Description |
| GET |
/api/groups |
Admin viewer |
List groups |
| GET |
/api/groups/:id |
Admin viewer |
Group detail (members, apps, links) |
| POST |
/api/groups |
Admin editor |
Create a group |
| PUT |
/api/groups/:id |
Admin editor |
Update a group |
| DELETE |
/api/groups/:id |
Admin editor |
Delete a group |
| POST |
/api/groups/bulk-delete |
Admin editor |
Delete several groups |
| POST |
/api/groups/:id/members |
Admin editor |
Add members |
| DELETE |
/api/groups/:id/members/:userId |
Admin editor |
Remove a member |
| POST |
/api/groups/:id/apps |
Admin editor |
Give a group access to apps |
| DELETE |
/api/groups/:id/apps/:appId |
Admin editor |
Remove an app from a group |
| POST |
/api/groups/:id/apps/transfer |
Admin editor |
Copy or move all apps to another group |
| POST |
/api/groups/:id/groups |
Admin editor |
Link child groups |
| DELETE |
/api/groups/:id/groups/:childGroupId |
Admin editor |
Unlink a child group |
| POST |
/api/groups/:id/entra-groups |
Admin editor |
Link Entra groups |
| DELETE |
/api/groups/:id/entra-groups/:entraGroupId |
Admin editor |
Unlink an Entra group |
| GET |
/api/groups/entra/candidates |
Admin viewer |
Discovered Entra groups available for import |
| POST |
/api/groups/entra/import |
Admin editor |
Import discovered Entra groups |
| POST |
/api/groups/entra/force-sync |
Admin editor |
Sync Entra memberships for all linked users |
| Method |
Endpoint |
Auth |
Description |
| GET |
/api/media-assets |
Admin viewer |
Media library (icons and logos) |
| GET |
/api/media-assets/large-icons |
Admin viewer |
App icons larger than 200 KB, with pixel size and whether they can be optimized |
| GET |
/api/media-assets/:id |
Admin viewer |
Media asset detail |
| GET |
/api/media-assets/:id/file |
Admin viewer |
Media asset file (images only) |
| DELETE |
/api/media-assets/:id |
Admin editor |
Delete an unused media asset |
Logs and audit
| Method |
Endpoint |
Auth |
Description |
| GET |
/api/logs |
Owner |
Access logs (paginated) |
| GET |
/api/logs/top-apps |
Owner |
Most opened apps |
| POST |
/api/logs/clear-access |
Owner |
Clear the access log now |
| GET |
/api/logs/audit |
Owner |
Audit log (paginated; exclude_target_types=auth hides sign-ins). Alias: /api/logs/rbac-audit |
Backups
| Method |
Endpoint |
Auth |
Description |
| GET |
/api/backups/export |
Owner |
Download a backup |
| POST |
/api/backups/export-jobs |
Owner |
Start a backup in the background |
| GET |
/api/backups/export-jobs/:jobId/events |
Owner |
Backup progress (server-sent events) |
| GET |
/api/backups/export-jobs/:jobId/file |
Owner |
Download the finished backup |
| GET |
/api/backups/database |
Owner |
Raw database copy (.db) |
| POST |
/api/backups/verify |
Owner |
Check a backup without changing anything (binary upload) |
| POST |
/api/backups/restore |
Owner |
Restore a backup (binary upload) |
Plugins
The plugin endpoints (/api/plugins/*) answer 404 while the plugin platform is locked off. See Plugins.
