POST

Apps.Add

Upload a new static app ZIP. The ZIP is sent to the apps hosting server, scanned, extracted into the account folder, and served from the returned public_url. Only safe static files are allowed. Only the main user or a user-manager can add, update, or remove apps.

Permissions

User must be logged in with a valid bearer token.
The user must be from the same company domain as the request Host (call the API on that account subdomain or allowed custom domain). A token from another company returns success=0, error user_not_in_company.
Returned or changed records are limited by the user permissions, team access, folder access, and account settings.

Action

Creates a Apps record or sends the requested data after validation.

Push Service

No push is sent because this function only reads data or returns helper information.

Automation

No automation is run for this function.

Special Instructions

On a company subdomain (e.g. https://{user_domain}.bull36.com) the user must match that Host — Login and protected APIs reject another company with success=0, error user_not_in_company. On a main brand host (bull36.com, biz1.co.il, mastrocrm.com, …) the company domain gate is skipped.
ZIP max size is 25MB. Extracted app max size is 100MB. Max 500 files. Allowed files are static only: html, htm, js, css, json, images, fonts, txt, pdf. Blocked files include php, phtml, htaccess, exe, sh, py, asp, jsp, symlinks, absolute paths, ../ path traversal, and JavaScript dynamic execution such as eval, new Function, string setTimeout/setInterval, importScripts, and document.write.

Required Parameters

Name	Type	Sample	Explanation
`app_name` post	string	`Sample App`	Display name for the app. Alias: name.
`zip` file	zip file	`sampleapp.zip`	ZIP file containing static app files. Must include index.html at the ZIP root.

Optional Parameters

Name	Type	Sample	What it gives
`app_slug` post	string	`sampleapp`	Optional clean folder name. If omitted, the server creates it from app_name. Lowercase letters, numbers, dash, and underscore only.

Authentication

Send the bearer token returned by Login in the request header. The user must be from the same company domain as this Host — a token from another company is rejected (user_not_in_company).

Authorization: Bearer YOUR TOKEN

Sample Request

{
    "url": "\/app\/Apps.Add",
    "method": "POST",
    "headers": {
        "Authorization": "Bearer YOUR TOKEN"
    },
    "body": {
        "app_name": "Sample App",
        "app_slug": "sampleapp",
        "zip": "sampleapp.zip"
    },
    "url_user": "https:\/\/{user}.bull36.com\/app\/Apps.Add",
    "url_domain": "https:\/\/{domain}\/app\/Apps.Add"
}

Endpoint

POST /app/Apps.Add
POST https://{user}.bull36.com/app/Apps.Add
POST https://{domain}/app/Apps.Add

Sample Output

{
    "success": 1,
    "app_id": 12,
    "app_slug": "sampleapp",
    "status": "active",
    "public_url": "https:\/\/apps.biz1.co.il\/eli\/sampleapp\/",
    "message": "App uploaded successfully."
}

JavaScript Example

const token = 'YOUR TOKEN';
const form = new FormData();
form.set('app_name', 'Sample App');
form.set('app_slug', 'sampleapp');
form.set('zip', fileInput.files[0]);
const res = await fetch('/app/Apps.Add', { method: 'POST', headers: { Authorization: 'Bearer ' + token }, body: form });
const data = await res.json();
console.log(data.public_url);

Error Example

{
    "success": 0,
    "error": "zip_rejected",
    "message": "ZIP contains blocked file type: app.php"
}