Get Flags

Request

GET /api/v1/flags

Headers

Header	Required	Description
`X-Bundle-ID`	Yes	App bundle identifier
`X-Team-ID`	Yes	Apple Developer Team ID
`Authorization`	Yes	`Bearer <attestation JWT>` — or an API key for server-side/simulator callers. Identity headers alone return 401. See Authentication

Device context headers

Targeting rules match against these optional headers. Send them to get rule-resolved values; omit them all and every flag falls back to its environment default.

Header	Example	Rule attribute
`X-Device-Model`	`iPhone16,1`	`device_model`
`X-OS-Version`	`18.1.2`	`os_version`
`X-App-Version`	`2.1.0`	`app_version`
`X-Device-ID`	`abc123`	`device_id` — also the bucketing key for percentage rollouts and the lookup key for overrides
`X-Risk-Score`	`12`	`risk_score`
`X-Locale`	`en_US`	`locale`
`X-Country`	`US`	`country`
`X-User-ID`	`user_123`	`user_id`
`X-Attestation-Status`	`attested`	`attestation_status` — `attested`, `unattested`, or `expired`
`X-Custom-<key>`	`X-Custom-beta-group: internal`	`custom.<key>`

Rate limit headers

Responses include X-RateLimit-Limit, X-RateLimit-Remaining, and X-RateLimit-Reset from the flags bucket. 429 responses include Retry-After.

Query parameters

Parameter	Type	Default	Description
`environment`	`string`	`production`	Environment slug. Unknown slugs return an empty flag map rather than an error

Response

{
  "flags": {
    "beta_features": false,
    "dark_mode": true,
    "theme": "modern",
    "upload_limit": 50
  }
}

Values are typed according to each flag’s value type (boolean, integer, double, string, or JSON), and keys are sorted alphabetically.

How a value is resolved

For each flag, in order:

An active per-device override matching X-Device-ID wins outright.
Otherwise targeting rules are evaluated in priority order; the first rule whose conditions all match and whose rollout admits the device supplies the value. Rules are skipped entirely when no device context headers are sent.
Otherwise the flag’s value for that environment is used — its “on” value when the flag is active in that environment, its “off” value when it is not.

Flags with no configured value in the requested environment are omitted from the map. A request carrying identity headers sees that app’s flags plus the organization-wide ones; an API-key request without identity headers sees only the organization-wide flags. Every returned flag is recorded as an evaluation, which is what the dashboard’s flag evaluation feed reports.

List environments

GET /api/v1/flags/environments

Same authentication and rate-limit bucket. Returns your organization’s flag environments in sort order.

[
  {
    "id": "550e8400-e29b-41d4-a716-446655440000",
    "name": "Production",
    "slug": "production",
    "color": "#6b7280",
    "isDefault": true,
    "sortOrder": 0,
    "createdAt": "2026-01-15T12:00:00Z"
  }
]

Tier limits

Tier	Max flags	Max environments
Free	10	1
Pro	50	3
Business	200	10
Enterprise	Unlimited	Unlimited

Overview

Attestation

Platform

Feedback

Feature Flags

Custom Claims

Analytics

Webhooks

Organization

Push

Entitlements

Visual Regression Testing

Auth

Request

Headers

Device context headers

Rate limit headers

Query parameters

Response

How a value is resolved

List environments

Tier limits

See also

​Request

​Headers

​Device context headers

​Rate limit headers

​Query parameters

​Response

​How a value is resolved

​List environments

​Tier limits

​See also

Request

Headers

Device context headers

Rate limit headers

Query parameters

Response

How a value is resolved

List environments

Tier limits

See also