App directory

The directory at upstream.codes/apps lists public apps, most installed first. Anyone can browse it without signing in. There's no review step. An owner lists an app by letting anyone install it.

List your app

Under Installation in your app's settings:

1. Turn on Anyone can install.
2. Leave Show in the directory on. It's on by default.

To keep a public app out of the directory, turn Show in the directory off. Its page still works for anyone with the link. Apps only the owner can install never appear.

Pages

URL	Shows
https://upstream.codes/apps	Every listed app. Search with ?q=.
https://upstream.codes/apps/{slug}	The app's owner, description, permissions, events and install count, with an install button
https://upstream.codes/apps/{slug}/installations/new	The install page. It needs sign-in.

In Coline, the directory is at /{workspace}/upstream/apps.

Directory API

Both endpoints are public and need no token.

curl "https://api.upstream.codes/v1/apps?q=ci&page=1"

{
  "data": {
    "apps": [
      {
        "id": "8a1f2c3d-…",
        "slug": "acme-ci",
        "name": "Acme CI",
        "description": "Runs Acme CI on every push.",
        "homepageUrl": "https://ci.acme.dev",
        "owner": { "namespace": "acme", "name": "Acme", "type": "Organization" },
        "permissions": ["repo:read", "changes:read", "checks:write"],
        "events": ["check_suite", "check_run"],
        "installCount": 42,
        "createdAt": "2026-11-02T17:20:00.000Z"
      }
    ],
    "page": 1,
    "hasMore": false
  }
}

q matches names, slugs and descriptions. A page holds 24 apps. Apps are sorted by active installations, then by name. Search is in the native dialect only.

curl https://api.upstream.codes/v1/apps/acme-ci
curl https://api.upstream.codes/api/v3/apps/acme-ci

GET /apps/{app_slug} works for any app anyone can install, listed or not. The native answer adds botHandle, webhookFormat, listed and deviceFlowEnabled. The GitHub-compatible answer has GitHub's app shape, so Octokit's apps.getBySlug works. Private and suspended apps return 404.

Report an app

Signed-in people can report an app from its page. They pick a reason, spam, malware, impersonation, abuse or other, and describe the problem in 10 to 2,000 characters. Each person has one open report per app, and reporting again updates it.

Upstream staff review reports. They can suspend an app, which stops its JWTs, installation tokens, sign-ins and webhooks, and removes it from the directory. Installations stay, so nothing is lost if it comes back. The owner sees that Upstream suspended the app and can't resume it. Contact support@coline.app to have a suspension reviewed.

Owners can suspend and resume their own apps from the app's settings.