hosting
GET /v1/sites/{siteId}/application-access
The sign-in details for the application installed on a site.
Authentication
Send an API key as a bearer token. The endpoint checks sites.view; a key without it is refused with 403, not 404.
This endpoint takes no organisation id. Your key already identifies the organisation it belongs to, and the response is scoped to it.
Try it
Replace anything in angle brackets with your own values, and the key placeholder with a key from your dashboard.
curl -X GET https://api.zinndigital.com/v1/sites/{siteId}/application-access \
-H "Authorization: Bearer zdk_live_…"Signed in? The API console in your dashboard fills in your real organisation id and your own key, and runs the request against the live API so you can see the actual response. Open this endpoint in the API console
Details
Everything a customer needs to sign in to the Nextcloud, ownCloud or headless CMS we installed for them: where to sign in, the administrator username, and the password. ⛔ The password is derived, never stored — the same design GET /v1/sites/{siteId}/wp-credentials uses (engine.hosting.site_secrets), so there is no per-site secret at rest to leak and a retried deploy re-derives the identical value. can_reveal is false when it cannot be shown: either the deployment has no master key configured, or the customer changed the password themselves, and the screen must say which rather than render an empty field. This read is audit-logged, because "who looked at this site's administrator password" is exactly the question an incident asks afterwards.
Parameters
| Name | Type | Required | What it is |
|---|---|---|---|
siteId (path) | Uuid | Yes | Site ID (UUIDv7). |
Response
| Name | Type | Required | What it is |
|---|---|---|---|
application | string | Yes | — |
name | string | Yes | — |
login_url | string | Yes | The full URL to sign in at. |
username | string | Yes | The administrator account the installer created. |
password | string | Yes | The administrator password, or "" when it cannot be shown. Never stored — it is derived on read from the platform master key and the site's rotation epoch. |
can_reveal | boolean | Yes | Whether password holds a value that can be shown. |
is_custom | boolean | Yes | The customer set their own password, so there is nothing of ours to show. The screen says so rather than offering a reveal that would produce a blank. |
vendor_url | string | No | — |
Errors this endpoint can return
401 · 403 · 404 · 429