GET /api/v1/app

App categorization API: category and IDs for any app

Send a bundle ID, App Store ID or Android package name. Get back the app's filtering categories, IAB category, App Store age rating, developer and its twin ID on the other store.

One request, one app, plain JSON. Built for scripts, help desks and products that need to decide about an app in a second.

# Android package in, iOS twin out
GET /api/v1/app?id=com.openai.chatgpt&api_key=YOUR_KEY

{
  "found": true,
  "name": "ChatGPT",
  "bundle_id": "com.openai.chat",
  "app_store_id": 6448311069,
  "android_package": "com.openai.chatgpt",
  "age_rating": "12+",
  "filtering_categories": [
    "AI / LLM Tools",
    "Education/Reference",
    "Computers & Technology"
  ]
}

Quick start

Three steps from no key to your first answer.

01

Get a key

Order the API plan, or use the key that comes with the Districts and IT Providers plan.

02

Send one GET request

Pass the app ID and your key as query parameters. No headers or tokens to sign.

03

Read the JSON

Check found, then act on filtering_categories and age_rating.

Endpoint and parameters

There is one endpoint. It answers over HTTPS with a JSON body.

GEThttps://www.appblocklist.com/api/v1/app?id=<bundle ID | App Store ID | Android package>&api_key=YOUR_KEY
ParameterValueNotes
idrequiredOne bundle ID, App Store ID or Android package nameURL-encode it. The API works out which kind of ID you sent.
api_keyrequiredYour API keyOne key per plan. Keep it on servers and in scripts, never in browser code.

Accepted ID formats

Send whichever ID you have. Device inventories in MDMs usually show the bundle ID or package name, while store links carry the App Store ID.

ID typeWhat it looks likeExample (TikTok)
iOS bundle IDReverse domain text, letter case keptcom.zhiliaoapp.musically
App Store IDDigits only, the number at the end of an App Store link835599320
Android packageReverse domain text from a Google Play listingcom.zhiliaoapp.musically

Some apps use the same text for both stores, as TikTok does. Others differ: Instagram is com.burbn.instagram on iOS and com.instagram.android on Android. One lookup returns both. To find IDs by hand, try the bundle ID lookup or the package name lookup.

Response

A successful lookup returns HTTP 200 and one JSON object. This is the full response for TikTok, looked up by its App Store ID.

Request GET /api/v1/app?id=835599320&api_key=YOUR_KEY
{
  "found": true,
  "app_store_id": 835599320,
  "bundle_id": "com.zhiliaoapp.musically",
  "name": "TikTok - Videos, Shop & LIVE",
  "developer": "TikTok Ltd.",
  "developer_domain": "tiktok.com",
  "app_store_genre": "Entertainment",
  "age_rating": "12+",
  "android_package": "com.zhiliaoapp.musically",
  "filtering_categories": [
    "Arts & Entertainment",
    "Streaming Media",
    "Social Networking",
    "Shopping"
  ],
  "iab_category": "Entertainment"
}
FieldTypeMeaning
foundbooleanTrue when the app is in our database. Check it first.
app_store_idintegerNumeric App Store ID. Stable for the life of the app.
bundle_idstringiOS bundle ID, the value MDM restrictions use.
namestringApp name as listed in the App Store.
developerstringDeveloper or seller name as listed.
developer_domainstringDomain of the developer's website. Useful for joining to web filter data.
app_store_genrestringPrimary App Store genre, one of 26.
age_ratingstringAge rating as listed in the App Store.
android_packagestring or nullGoogle Play package of the same app, when it is on both stores.
filtering_categoriesarrayOne or more of our 58 filtering categories, ranked. The first is the main purpose.
iab_categorystringIAB Content Taxonomy 3.0 category as a path from tier 1 down.

Turning answers into decisions

Most integrations end in one of three actions: allow, review or block. These are common starting rules that schools and IT teams adapt to their own policy.

If the answer showsStudent devicesWork devices
VPN / Proxy / Anonymizers in filtering_categoriesBlockBlock unless it is your company VPN
AI / LLM ToolsBlock or review against your AI policyAllow approved tools, review the rest
Gambling, Dating or AdultBlockBlock
Remote Access ToolsBlockAllow only the tool your IT team uses
Social Networking, Streaming Media, GamingBlock in class time policiesReview per role
age_rating of 17+Block for under-18 groupsUsually no rule
Education/Reference as the first categoryAllow or fast-track the requestAllow

Strict rule: any category

Block when any listed category is in your blocked set. Safer for young students, since an app with a hidden chat or shop is caught.

Lenient rule: main category

Block only when the first category is in your blocked set. Fewer false alarms on work devices, where a side feature matters less.

Errors

Errors use standard HTTP status codes with a short JSON message. Handle 404 as a normal answer, not a failure: it means the ID is not an app we know.

StatusMeaningWhat to do
200App found, full record returnedRead the fields.
400The id parameter is missing or not a valid IDCheck for empty values, spaces or a full store link instead of the ID.
401The api_key is missing or invalidCheck the key is sent in the query and has no extra characters.
403This month's lookups are used upWait for the next month, or ask us for a higher volume.
404App not found, found is falseCheck the ID with the lookup tool. Brand new or removed apps may not be listed.

Rate limits and quotas

The API plan is metered by month. Plan your jobs around the monthly allowance, and send requests at a steady pace.

100,000
lookups a month on the $99 plan
1 ID
per request, one app per answer
403
when the month's lookups are used up
  • Send requests one after another and wait for each answer. Large parallel bursts can be slowed down.
  • Cache answers. Categories change slowly and the data refreshes monthly, so a month-long cache is safe.
  • Look up only new IDs. Keep a table of IDs you have already checked and skip them next time.
  • For one-off jobs of hundreds of thousands of apps, the mobile app database costs less than repeated lookups.
  • Need more than 100,000 lookups a month? Higher volumes are quoted.

Code examples

Copy, replace YOUR_KEY, run. Each example handles the not-found case.

curl

The quickest test from any terminal on macOS, Linux or Windows.

curl "https://www.appblocklist.com/api/v1/app?id=com.zhiliaoapp.musically&api_key=YOUR_KEY"
Python

Uses the requests library. Returns None when the app is not found.

import requests

API_KEY = "YOUR_KEY"
URL = "https://www.appblocklist.com/api/v1/app"

def lookup(app_id):
    r = requests.get(URL, params={"id": app_id, "api_key": API_KEY}, timeout=15)
    if r.status_code == 404:
        return None
    r.raise_for_status()
    return r.json()

app = lookup("835599320")
if app:
    print(app["name"], app["age_rating"], app["filtering_categories"])
PowerShell for Intune admins

Reads a text file of bundle IDs, for example copied from your Intune app inventory, and flags apps in the categories you block. Results go to a CSV for review.

$ApiKey  = "YOUR_KEY"
$Blocked = @("VPN / Proxy / Anonymizers", "AI / LLM Tools", "Gambling", "Dating")

$Results = foreach ($Id in Get-Content ".\bundle-ids.txt") {
    $Uri = "https://www.appblocklist.com/api/v1/app?id=$([uri]::EscapeDataString($Id))&api_key=$ApiKey"
    try {
        $App = Invoke-RestMethod -Uri $Uri -Method Get
        $Hit = @($App.filtering_categories | Where-Object { $Blocked -contains $_ })
        [pscustomobject]@{
            BundleId   = $Id
            Name       = $App.name
            Categories = ($App.filtering_categories -join "; ")
            AgeRating  = $App.age_rating
            Android    = $App.android_package
            Flag       = ($Hit.Count -gt 0)
        }
    } catch {
        [pscustomobject]@{ BundleId = $Id; Name = "not found"; Categories = ""; AgeRating = ""; Android = ""; Flag = $false }
    }
    Start-Sleep -Milliseconds 200
}

$Results | Export-Csv ".\app-review.csv" -NoTypeInformation
JavaScript (Node.js)

Uses the built-in fetch of current Node.js versions. Keep the key in an environment variable on the server.

const API_KEY = process.env.ABL_API_KEY;

async function lookup(id) {
  const url = new URL("https://www.appblocklist.com/api/v1/app");
  url.searchParams.set("id", id);
  url.searchParams.set("api_key", API_KEY);
  const res = await fetch(url);
  if (res.status === 404) return null;
  if (!res.ok) throw new Error("Lookup failed with status " + res.status);
  return res.json();
}

lookup("com.openai.chat").then((app) => {
  if (app) console.log(app.name, app.android_package, app.filtering_categories);
});

Keep the key private. Call the API from a server, a script or an admin tool, not from browser code or an app you ship, because anyone who can read the key can spend your lookups.

Test your integration

Five calls cover every path your code needs to handle. Run them once before you point the script at real inventory.

SendExpectChecks that
id=835599320200, TikTok recordApp Store IDs work
id=com.burbn.instagram200, Android package com.instagram.androidBundle IDs work and twin IDs are read
id=com.openai.chatgpt200, bundle ID com.openai.chatAndroid packages work
An empty id400Your code rejects bad input
A wrong api_key401Key errors are reported, not retried forever

Successful test calls count as lookups like any other, so the tests cost almost nothing from your 100,000. Log the status code of every call so a 403 at month end is easy to spot.

What teams build with it

The API answers "what is this app?" wherever that question comes up in your work.

Inventory review in Intune or Jamf

Run your device app inventory through the API and flag VPN, AI, gambling and remote access apps before they become a problem. Then block them, as in our Intune blocking guide.

App request approvals

When a teacher or employee asks for an app, the help desk form shows its categories, age rating and developer at once.

District edtech vetting

Add category and age facts to every app review, next to privacy checks. See our edtech app vetting guide.

MSP client onboarding

Scan a new client's devices on day one and show them which apps fall into risky categories.

Cross-platform blocklists

Block an app on iOS and get its Android package from the same answer, so both lists stay in step. Our TikTok blocking guide shows both IDs in use.

Monthly risk reports

Count the apps in each risky category across your fleet every month and show leadership whether the numbers go down.

Help desk triage

When a user reports a strange app, paste its ID into an internal tool and see its developer and categories before you call back.

Filters and parental control products

Categorize apps on demand inside your own product, then move to a licensed file when volumes grow.

What you send, and what you never send

Privacy reviews for school and company tools ask what leaves your network. For this API the answer is short.

Sent with each request

  • One app ID
  • Your API key
  • Nothing else is needed

Never needed

  • Student, staff or customer names
  • Device serial numbers or locations
  • Browsing history or app usage

Strip any user or device columns from inventory exports before you loop over them, and send only the app ID column.

How this differs from Apple's APIs

Admins often search for an App Store API key or the Apple School Manager API when they want app categories. Those APIs do different jobs.

App Store Connect APIApple School Manager and Apple Business Manager APIAppBlockList App Lookup API
Made forDevelopers managing their own appsOrganizations managing their own devicesAnyone who needs facts about any app
AnswersBuilds, metadata, sales and testers for your appsDevice inventory and which MDM server each device is assigned toCategories, age rating, developer and both store IDs
CredentialsKey ID, issuer ID and signed tokensAn API account with a private keyOne API key in the query
Covers other people's appsNoNoYes

You do not need an App Store Connect key, an issuer ID or an Apple School Manager API account to use our API. If you only want a person-friendly view, the app category lookup shows the same facts in your browser.

Pricing

A flat monthly price with a monthly allowance. No free tier and no trial.

App Lookup API

$99 per month

100,000 lookups a month. Higher volumes are quoted. Also included in the Districts and IT Providers plan with the blocklists. Compare everything on the pricing page.

  • All fields in every answer
  • Bundle ID, App Store ID or Android package in
  • Same data as the monthly blocklist files
  • One key, clear error codes
  • Need ready MDM files too? See the blocklist feed

API questions

What developers and admins ask before their first call.

Is there a free API key?

No. API access starts at $99 per month for 100,000 lookups, or comes with the Districts and IT Providers plan. The lookup tool on our site is free for a few checks a day if you only need to look at single apps by hand.

Is this the App Store Connect API?

No. The App Store Connect API is Apple's API for developers to manage their own apps, and it needs a key ID, an issuer ID and signed tokens. Our API describes any app on the store and needs only one API key.

Can I send an app name instead of an ID?

The API takes IDs only: a bundle ID, an App Store ID or an Android package name. To find an app by name, use the app category lookup on our site, then send its ID to the API.

Can I send several IDs in one request?

No. Each request takes one ID and returns one app. For checks of tens of thousands of apps at once, the mobile app database is the better tool.

How fresh is the data?

The API serves the same data as our monthly blocklist files. New apps appear after the next monthly update.

Does the API cover Chrome extensions or websites?

No. It covers mobile apps identified by bundle ID, App Store ID or Android package name. Chrome extensions and websites are outside this API.

What does a null android_package mean?

The app has no Google Play twin that we know of. Many iPhone apps are only on the App Store, so a null value is normal.

Can every school in a district use the included API?

Yes. The Districts and IT Providers plan includes one API key with 100,000 lookups a month, which you can use for all the schools or clients on the plan.

Can I call the API from a browser or a mobile app?

Call it from a server, a script or an admin tool, so the key stays private. Anyone who can see a key in browser code or an app package can use your monthly lookups.

Get your API key

$99 per month for 100,000 lookups. Tell us where you will call it from and we reply within one business day.

Apple, App Store, App Store Connect, Apple School Manager, Apple Business Manager, iPhone and iOS are trademarks of Apple Inc. Google Play and Android are trademarks of Google LLC. Microsoft Intune, PowerShell and Windows are trademarks of Microsoft Corporation. Jamf is a trademark of Jamf Software, LLC. TikTok is a trademark of ByteDance Ltd. ChatGPT is a trademark of OpenAI. Instagram is a trademark of Meta Platforms, Inc. Python is a trademark of the Python Software Foundation. JavaScript is a trademark of Oracle Corporation. Node.js is a trademark of the OpenJS Foundation. Names are used only to identify the products discussed. AppBlockList is not affiliated with, sponsored or endorsed by these companies.