# Get an application

> Get an application: reference page for this CustomDomain™ API operation in the applications group. Covers parameters, request body, responses and error codes.

Source: https://docs.customdomain.ai/docs/api-reference/applications/getApplication

## `GET https://api.customdomain.ai/v1/applications/{id}`

Returns the application with its settings. `end_user_saved_access` says whether a returning end user may reuse the access their own secure sign-in kept (change it with `PATCH /applications/{id}`), and `secure_sign_in` says whether the secure sign-in can run for the workspace at all (read only). Every answer that carries an application has both: the list, the create and the update too.

### Authentication

`managementKey`, `apiKey`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `id` | path | string | yes |  |

### Responses

| Status | Description |
| --- | --- |
| `200` | Application |
| `401` | Error envelope: {code, title, details}. |
| `404` | Error envelope: {code, title, details}. |

### `200` response body

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `id` | string | yes |  |
| `tenant_id` | string | no |  |
| `name` | string | yes |  |
| `environment` | `production`, `staging`, `development` | no |  |
| `default_origin` | string | no |  |
| `connect_target` | object | no |  |
| `sandbox` | boolean | no | `true` for a **test mode** application, made with `"sandbox": true` on `POST /applications`. It runs the whole connect flow end to end (the widget, the API, webhooks) against simulated DNS, on reserved `.test` names only, and never touches a real domain, the free domain, the quota or billing. Fixed when the application is created. Omitted (treated as `false`) on a live application. |
| `nameserver_migration` | object | no | Whether and how the application offers to move an end user's nameservers. It is the one switch for every DNS hosting offer the widget makes. `off` (the default): never offered, and the setting is omitted; a widget token can't start managed DNS either, nor while the target is `dns_host` or `custom`. `offer`: the widget shows the move as a quiet second choice beside adding records. `prefer`: the move is the first choice. Send `{"mode": "off"}` to clear it. |
| `end_user_saved_access` | boolean | no | A returning end user may reuse the access their own secure sign-in kept, for their next domain in this application, after one tap of consent. On by default; set it with `PATCH /applications/{id}`. The access is that end user's own: bound to them and to this application, never usable by your team or by another end user. Always `false` for a test mode application, whose sign-ins are simulated and keep nothing. |
| `secure_sign_in` | object | no | Whether the secure sign-in (the widget's cloud browser way to connect) can run for this application's workspace at all, for any provider. Read only: it follows how this deployment is set up, not a setting of the application. Whether it runs for one domain is the `cloud_browser` entry of that domain's `rails`. |
| `created_at` | string | no |  |

The full specification is served at `GET https://api.customdomain.ai/v1/openapi.json`.