See every app

People build apps here on their own, often with an agent. This page is for whoever has to know what’s out there: one list of every app in the workspace, who can open each one, and where each one sends data. It’s on every plan, for the workspace’s owners and admins. Members see only the apps shared with them.

The list of apps

Open the workspace in the dashboard and go to Apps. Owners and admins get a row for every app, whether or not it’s shared with them, with these columns:

Column	What it says
Status	`Live · v4` with its live version, `Not deployed`, or why it’s paused or suspended.
Runs on	Workers or Container. On a computer it’s in the CSV and on a phone, as there’s no room for it beside the rest.
Who can open it	Private or everyone in the workspace, then how many people it’s shared with and how many of them are outside the workspace, every domain it’s shared with, and how many agents it’s granted to. A private app nobody else can open says not shared yet.
Sends requests to	The hosts the app sent requests to in the last 30 days, busiest first. See Sending requests out.
Created by	Who made it. On a laptop, beside the sidebar, it’s in the CSV and on a phone.
Last opened	When a request last reached it, to the hour: This hour, how many hours or days ago, or Never. On a laptop, beside the sidebar, it’s in the CSV and on a phone.
Requests	Requests to it in the window the page shows.

Who can open it counts each person once, whether the app is shared with them by email or through a group. Whoever made the app isn’t counted while they’re in the workspace. A domain is named, not counted, since everyone at it can open the app.

All, Live and Not deployed filter the list. When someone is waiting on a request for access, the app’s row says how many, and a line above the list links to each app with requests waiting.

Download it as CSV

Download CSV saves the list with the filter you picked, one row per app:

App,Address,Status,Runs on,Who can open it,Shared with,Outside the workspace,Domains,Agents,Custom domains,Sends requests to,Created by,Last opened (UTC hour),Requests 24h,Refused 24h,Created

The CSV is on every plan. The two request columns follow the window the page shows. Domains names each domain the app is shared with, like acme.com, with a space between them.

From the CLI or the API

jiayang app list acme gives the same list. For owners and admins, a line under each app says who can open it, what it reaches and when it was last opened:

payroll                        v12   private    owner   https://payroll--acme.jiayang-apps.cloud
  shared with 4 people, 1 outside the workspace · everyone at @acme.com · 2 agents · sends to api.stripe.com · last opened 2026-10-02 · made by ada@acme.com

With --json, each app has an oversight object:

Field	What it holds
`people`	How many people it’s shared with, each once, leaving out its maker while they’re in the workspace.
`outside`	How many of them aren’t in the workspace.
`domains`	The domains it’s shared with. Left out when there are none.
`agents`	How many agents it’s granted to. Left out when none.
`sends_to`	Up to ten hosts it sent requests to in the last 30 days, busiest first. Left out when none.
`custom_domains`	Its verified custom domains. Left out when none.
`last_opened`	The start of the last hour, in UTC, that a request reached it, or `null`.

Each app also has access_requests when people are waiting on an answer. The API behind it is GET /v1/workspaces/<workspace>/apps.

What happened, and who did it

The audit log has every request let in or refused, and every change, with who made it: a person, an agent, a bypass token, a GitHub run or a scheduled job. Read it on the Activity page, with jiayang audit acme, or live with jiayang watch acme. jiayang top acme is a live view of the busiest apps and callers.

The log is kept for 3 months on Free and Team, and 12 months on Business and Enterprise.

Who uses what

Usage insights count the log into people and visits: how many people opened each app, how often, and when last, which apps nobody opened in 30, 60 or 90 days, and which apps’ owners have all left. Open Insights in the dashboard, or run jiayang insights acme. They look back 30 days on Free, 90 on Team and 365 on Business and Enterprise.

Downloading the log as CSV and streaming it to your SIEM, Splunk, Datadog, a collector of yours or an S3 bucket, are Enterprise features. They’re included on Business for early customers, for a limited time. On every plan, the workspace export below has the same entries as JSON, and the audit API returns them with a cursor to follow.

Your apps’ own logs, what their code prints and throws, can go to your log tools too, with log drains on Team, Business and Enterprise. The Log drains page lists every drain in the workspace, for every app or one, and where each sends. Every owner is emailed when one is added.

Export everything

An owner can export the whole workspace as one JSON file: under Settings, in Your data, select Export. It needs a browser that signed in in the last 15 minutes. jiayang workspace export acme opens that page. The CLI can’t download it itself: a CLI session can deploy, but it can’t carry the workspace off. It has:

the workspace’s settings, plan and allowed email domains,
its members, groups and who is in each,
every app, with who it’s shared with, its custom domains, its outbound list and AI budgets,
the names of its tokens, secrets and environment variables, never their values, and each public path’s verifier without its secret,
its agents and their credentials, never a credential itself, and which AI keys it has, never a key,
its Postgres connections and the apps given each, never a password,
the audit log your plan keeps.

App data isn’t in it. Export each app’s database from its Settings, or with jiayang db export. Each export is in the audit log as workspace.export.

Hear about changes as they happen

Webhooks send each deploy, share, new member, new token and more to a URL of yours, signed: agents, groups, domains, GitHub, SSO and SCIM, the plan and billing, suspensions, outbound lists, AI keys and clients, Postgres connections, and files too.
Slack posts the same as a line in a channel.
Each Monday, owners get an email with the week’s deploys, shares, refused visits and usage.
Once a day at most, owners and admins get an email naming people who were turned away from an app because it isn’t shared with them.

Set the rules

Allowed email domains keep sharing inside your company.
Single sign-on sends your people through your identity provider, and can be required. SCIM adds and removes them, and fills groups.
Custom roles split duties: who deploys, who adds members, who reads the log or the bill. Your identity provider’s groups can give them.
A publish policy says who may open apps to the whole company, share them outside it, open public paths, make tokens and agent credentials, and connect AI clients. What was shared before a rule is listed for you to end.
An outbound list holds an app to the hosts you name.
A list of AI clients lets only the clients you approve connect to your MCP server apps: those on people’s own computers, such as Claude Code or Cursor, those on hosts you name, or single clients by id.
Your own encryption key, in a key service you run, seals your secrets: revoke it and nothing sealed under it can be read, by your apps or by us. Every use of it is in the log.
Company AI keys give apps your key for Anthropic, OpenAI, Gemini, Mistral, Groq, Cohere, Azure OpenAI or Amazon Bedrock with a monthly budget, without the key reaching their code.
Postgres connections give apps a database you already have, one app at a time, without its password reaching their code.
Nobody can make an app public. A public path opens only the paths an app names, for webhooks. To see an app’s, run jiayang app public-paths acme/hello.