App categorization API: category and IDs for any app
Send a bundle ID, App Store ID or Android package name. Get back the app's filtering categories, IAB category, App Store age rating, developer and its twin ID on the other store.
One request, one app, plain JSON. Built for scripts, help desks and products that need to decide about an app in a second.
# Android package in, iOS twin out GET /api/v1/app?id=com.openai.chatgpt&api_key=YOUR_KEY { "found": true, "name": "ChatGPT", "bundle_id": "com.openai.chat", "app_store_id": 6448311069, "android_package": "com.openai.chatgpt", "age_rating": "12+", "filtering_categories": [ "AI / LLM Tools", "Education/Reference", "Computers & Technology" ] }
Quick start
Three steps from no key to your first answer.
Get a key
Order the API plan, or use the key that comes with the Districts and IT Providers plan.
Send one GET request
Pass the app ID and your key as query parameters. No headers or tokens to sign.
Read the JSON
Check found, then act on filtering_categories and age_rating.
Endpoint and parameters
There is one endpoint. It answers over HTTPS with a JSON body.
| Parameter | Value | Notes |
|---|---|---|
| idrequired | One bundle ID, App Store ID or Android package name | URL-encode it. The API works out which kind of ID you sent. |
| api_keyrequired | Your API key | One key per plan. Keep it on servers and in scripts, never in browser code. |
Accepted ID formats
Send whichever ID you have. Device inventories in MDMs usually show the bundle ID or package name, while store links carry the App Store ID.
| ID type | What it looks like | Example (TikTok) |
|---|---|---|
| iOS bundle ID | Reverse domain text, letter case kept | com.zhiliaoapp.musically |
| App Store ID | Digits only, the number at the end of an App Store link | 835599320 |
| Android package | Reverse domain text from a Google Play listing | com.zhiliaoapp.musically |
Some apps use the same text for both stores, as TikTok does. Others differ: Instagram is com.burbn.instagram on iOS and com.instagram.android on Android. One lookup returns both. To find IDs by hand, try the bundle ID lookup or the package name lookup.
Response
A successful lookup returns HTTP 200 and one JSON object. This is the full response for TikTok, looked up by its App Store ID.
{
"found": true,
"app_store_id": 835599320,
"bundle_id": "com.zhiliaoapp.musically",
"name": "TikTok - Videos, Shop & LIVE",
"developer": "TikTok Ltd.",
"developer_domain": "tiktok.com",
"app_store_genre": "Entertainment",
"age_rating": "12+",
"android_package": "com.zhiliaoapp.musically",
"filtering_categories": [
"Arts & Entertainment",
"Streaming Media",
"Social Networking",
"Shopping"
],
"iab_category": "Entertainment"
}
| Field | Type | Meaning |
|---|---|---|
| found | boolean | True when the app is in our database. Check it first. |
| app_store_id | integer | Numeric App Store ID. Stable for the life of the app. |
| bundle_id | string | iOS bundle ID, the value MDM restrictions use. |
| name | string | App name as listed in the App Store. |
| developer | string | Developer or seller name as listed. |
| developer_domain | string | Domain of the developer's website. Useful for joining to web filter data. |
| app_store_genre | string | Primary App Store genre, one of 26. |
| age_rating | string | Age rating as listed in the App Store. |
| android_package | string or null | Google Play package of the same app, when it is on both stores. |
| filtering_categories | array | One or more of our 58 filtering categories, ranked. The first is the main purpose. |
| iab_category | string | IAB Content Taxonomy 3.0 category as a path from tier 1 down. |
Turning answers into decisions
Most integrations end in one of three actions: allow, review or block. These are common starting rules that schools and IT teams adapt to their own policy.
| If the answer shows | Student devices | Work devices |
|---|---|---|
| VPN / Proxy / Anonymizers in filtering_categories | Block | Block unless it is your company VPN |
| AI / LLM Tools | Block or review against your AI policy | Allow approved tools, review the rest |
| Gambling, Dating or Adult | Block | Block |
| Remote Access Tools | Block | Allow only the tool your IT team uses |
| Social Networking, Streaming Media, Gaming | Block in class time policies | Review per role |
| age_rating of 17+ | Block for under-18 groups | Usually no rule |
| Education/Reference as the first category | Allow or fast-track the request | Allow |
Strict rule: any category
Block when any listed category is in your blocked set. Safer for young students, since an app with a hidden chat or shop is caught.
Lenient rule: main category
Block only when the first category is in your blocked set. Fewer false alarms on work devices, where a side feature matters less.
Errors
Errors use standard HTTP status codes with a short JSON message. Handle 404 as a normal answer, not a failure: it means the ID is not an app we know.
| Status | Meaning | What to do |
|---|---|---|
| 200 | App found, full record returned | Read the fields. |
| 400 | The id parameter is missing or not a valid ID | Check for empty values, spaces or a full store link instead of the ID. |
| 401 | The api_key is missing or invalid | Check the key is sent in the query and has no extra characters. |
| 403 | This month's lookups are used up | Wait for the next month, or ask us for a higher volume. |
| 404 | App not found, found is false | Check the ID with the lookup tool. Brand new or removed apps may not be listed. |
Rate limits and quotas
The API plan is metered by month. Plan your jobs around the monthly allowance, and send requests at a steady pace.
- Send requests one after another and wait for each answer. Large parallel bursts can be slowed down.
- Cache answers. Categories change slowly and the data refreshes monthly, so a month-long cache is safe.
- Look up only new IDs. Keep a table of IDs you have already checked and skip them next time.
- For one-off jobs of hundreds of thousands of apps, the mobile app database costs less than repeated lookups.
- Need more than 100,000 lookups a month? Higher volumes are quoted.
Code examples
Copy, replace YOUR_KEY, run. Each example handles the not-found case.
curl
The quickest test from any terminal on macOS, Linux or Windows.
curl "https://www.appblocklist.com/api/v1/app?id=com.zhiliaoapp.musically&api_key=YOUR_KEY"
Python
Uses the requests library. Returns None when the app is not found.
import requests
API_KEY = "YOUR_KEY"
URL = "https://www.appblocklist.com/api/v1/app"
def lookup(app_id):
r = requests.get(URL, params={"id": app_id, "api_key": API_KEY}, timeout=15)
if r.status_code == 404:
return None
r.raise_for_status()
return r.json()
app = lookup("835599320")
if app:
print(app["name"], app["age_rating"], app["filtering_categories"])
PowerShell for Intune admins
Reads a text file of bundle IDs, for example copied from your Intune app inventory, and flags apps in the categories you block. Results go to a CSV for review.
$ApiKey = "YOUR_KEY"
$Blocked = @("VPN / Proxy / Anonymizers", "AI / LLM Tools", "Gambling", "Dating")
$Results = foreach ($Id in Get-Content ".\bundle-ids.txt") {
$Uri = "https://www.appblocklist.com/api/v1/app?id=$([uri]::EscapeDataString($Id))&api_key=$ApiKey"
try {
$App = Invoke-RestMethod -Uri $Uri -Method Get
$Hit = @($App.filtering_categories | Where-Object { $Blocked -contains $_ })
[pscustomobject]@{
BundleId = $Id
Name = $App.name
Categories = ($App.filtering_categories -join "; ")
AgeRating = $App.age_rating
Android = $App.android_package
Flag = ($Hit.Count -gt 0)
}
} catch {
[pscustomobject]@{ BundleId = $Id; Name = "not found"; Categories = ""; AgeRating = ""; Android = ""; Flag = $false }
}
Start-Sleep -Milliseconds 200
}
$Results | Export-Csv ".\app-review.csv" -NoTypeInformation
JavaScript (Node.js)
Uses the built-in fetch of current Node.js versions. Keep the key in an environment variable on the server.
const API_KEY = process.env.ABL_API_KEY;
async function lookup(id) {
const url = new URL("https://www.appblocklist.com/api/v1/app");
url.searchParams.set("id", id);
url.searchParams.set("api_key", API_KEY);
const res = await fetch(url);
if (res.status === 404) return null;
if (!res.ok) throw new Error("Lookup failed with status " + res.status);
return res.json();
}
lookup("com.openai.chat").then((app) => {
if (app) console.log(app.name, app.android_package, app.filtering_categories);
});
Keep the key private. Call the API from a server, a script or an admin tool, not from browser code or an app you ship, because anyone who can read the key can spend your lookups.
Test your integration
Five calls cover every path your code needs to handle. Run them once before you point the script at real inventory.
| Send | Expect | Checks that |
|---|---|---|
| id=835599320 | 200, TikTok record | App Store IDs work |
| id=com.burbn.instagram | 200, Android package com.instagram.android | Bundle IDs work and twin IDs are read |
| id=com.openai.chatgpt | 200, bundle ID com.openai.chat | Android packages work |
| An empty id | 400 | Your code rejects bad input |
| A wrong api_key | 401 | Key errors are reported, not retried forever |
Successful test calls count as lookups like any other, so the tests cost almost nothing from your 100,000. Log the status code of every call so a 403 at month end is easy to spot.
What teams build with it
The API answers "what is this app?" wherever that question comes up in your work.
Inventory review in Intune or Jamf
Run your device app inventory through the API and flag VPN, AI, gambling and remote access apps before they become a problem. Then block them, as in our Intune blocking guide.
App request approvals
When a teacher or employee asks for an app, the help desk form shows its categories, age rating and developer at once.
District edtech vetting
Add category and age facts to every app review, next to privacy checks. See our edtech app vetting guide.
MSP client onboarding
Scan a new client's devices on day one and show them which apps fall into risky categories.
Cross-platform blocklists
Block an app on iOS and get its Android package from the same answer, so both lists stay in step. Our TikTok blocking guide shows both IDs in use.
Monthly risk reports
Count the apps in each risky category across your fleet every month and show leadership whether the numbers go down.
Help desk triage
When a user reports a strange app, paste its ID into an internal tool and see its developer and categories before you call back.
Filters and parental control products
Categorize apps on demand inside your own product, then move to a licensed file when volumes grow.
What you send, and what you never send
Privacy reviews for school and company tools ask what leaves your network. For this API the answer is short.
Sent with each request
- One app ID
- Your API key
- Nothing else is needed
Never needed
- Student, staff or customer names
- Device serial numbers or locations
- Browsing history or app usage
Strip any user or device columns from inventory exports before you loop over them, and send only the app ID column.
How this differs from Apple's APIs
Admins often search for an App Store API key or the Apple School Manager API when they want app categories. Those APIs do different jobs.
| App Store Connect API | Apple School Manager and Apple Business Manager API | AppBlockList App Lookup API | |
|---|---|---|---|
| Made for | Developers managing their own apps | Organizations managing their own devices | Anyone who needs facts about any app |
| Answers | Builds, metadata, sales and testers for your apps | Device inventory and which MDM server each device is assigned to | Categories, age rating, developer and both store IDs |
| Credentials | Key ID, issuer ID and signed tokens | An API account with a private key | One API key in the query |
| Covers other people's apps | No | No | Yes |
You do not need an App Store Connect key, an issuer ID or an Apple School Manager API account to use our API. If you only want a person-friendly view, the app category lookup shows the same facts in your browser.
Pricing
A flat monthly price with a monthly allowance. No free tier and no trial.
App Lookup API
100,000 lookups a month. Higher volumes are quoted. Also included in the Districts and IT Providers plan with the blocklists. Compare everything on the pricing page.
- All fields in every answer
- Bundle ID, App Store ID or Android package in
- Same data as the monthly blocklist files
- One key, clear error codes
- Need ready MDM files too? See the blocklist feed
API questions
What developers and admins ask before their first call.
Is there a free API key?
No. API access starts at $99 per month for 100,000 lookups, or comes with the Districts and IT Providers plan. The lookup tool on our site is free for a few checks a day if you only need to look at single apps by hand.
Is this the App Store Connect API?
No. The App Store Connect API is Apple's API for developers to manage their own apps, and it needs a key ID, an issuer ID and signed tokens. Our API describes any app on the store and needs only one API key.
Can I send an app name instead of an ID?
The API takes IDs only: a bundle ID, an App Store ID or an Android package name. To find an app by name, use the app category lookup on our site, then send its ID to the API.
Can I send several IDs in one request?
No. Each request takes one ID and returns one app. For checks of tens of thousands of apps at once, the mobile app database is the better tool.
How fresh is the data?
The API serves the same data as our monthly blocklist files. New apps appear after the next monthly update.
Does the API cover Chrome extensions or websites?
No. It covers mobile apps identified by bundle ID, App Store ID or Android package name. Chrome extensions and websites are outside this API.
What does a null android_package mean?
The app has no Google Play twin that we know of. Many iPhone apps are only on the App Store, so a null value is normal.
Can every school in a district use the included API?
Yes. The Districts and IT Providers plan includes one API key with 100,000 lookups a month, which you can use for all the schools or clients on the plan.
Can I call the API from a browser or a mobile app?
Call it from a server, a script or an admin tool, so the key stays private. Anyone who can see a key in browser code or an app package can use your monthly lookups.
Get your API key
$99 per month for 100,000 lookups. Tell us where you will call it from and we reply within one business day.
Apple, App Store, App Store Connect, Apple School Manager, Apple Business Manager, iPhone and iOS are trademarks of Apple Inc. Google Play and Android are trademarks of Google LLC. Microsoft Intune, PowerShell and Windows are trademarks of Microsoft Corporation. Jamf is a trademark of Jamf Software, LLC. TikTok is a trademark of ByteDance Ltd. ChatGPT is a trademark of OpenAI. Instagram is a trademark of Meta Platforms, Inc. Python is a trademark of the Python Software Foundation. JavaScript is a trademark of Oracle Corporation. Node.js is a trademark of the OpenJS Foundation. Names are used only to identify the products discussed. AppBlockList is not affiliated with, sponsored or endorsed by these companies.