> ## Documentation Index
> Fetch the complete documentation index at: https://docs.base44.com/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Internal links on these pages omit the .md extension. Append .md to a docs page URL, or send an Accept: text/markdown header, to get that page as markdown.

# Enable core integration protection

> <Info>This API is in beta. Endpoints, fields, and behavior may still change, so avoid depending on it in production.</Info>

Turns on [core integration protection](/developers/references/apps-api/sections/security#core-integration-protection) for the app, so its pages can no longer call Base44's built-in integrations directly.

Check `core_integration_recommendation` in [Get security scan](/api-reference/get-security-scan) first. It says whether turning protection on is safe, and whether the app has to be [deployed](/api-reference/deploy-an-app) first.

The change applies right away. This endpoint can't turn the protection off, and calling it again once protection is on is refused.



## OpenAPI

````yaml /developers/references/app-management/app-management-openapi.json post /api/apps/{app_id}/security/scan/core-integrations/protect
openapi: 3.1.0
info:
  title: Base44 App Management API
  version: 1.0.0
servers:
  - url: https://app.base44.com
security:
  - PersonalAccessTokenAuth: []
paths:
  /api/apps/{app_id}/security/scan/core-integrations/protect:
    post:
      summary: Enable core integration protection
      description: >-
        <Info>This API is in beta. Endpoints, fields, and behavior may still
        change, so avoid depending on it in production.</Info>


        Turns on [core integration
        protection](/developers/references/apps-api/sections/security#core-integration-protection)
        for the app, so its pages can no longer call Base44's built-in
        integrations directly.


        Check `core_integration_recommendation` in [Get security
        scan](/api-reference/get-security-scan) first. It says whether turning
        protection on is safe, and whether the app has to be
        [deployed](/api-reference/deploy-an-app) first.


        The change applies right away. This endpoint can't turn the protection
        off, and calling it again once protection is on is refused.
      operationId: >-
        enable_core_integration_protection_api_apps__app_id__security_scan_core_integrations_protect_post
      parameters:
        - name: app_id
          in: path
          required: true
          schema:
            type: string
            description: ID of the app.
            title: App Id
          description: ID of the app.
          example: 6820f3a4e7b91d003c45a1f2
      responses:
        '200':
          description: Protection is on.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CoreIntegrationProtectionEnabled'
        '401':
          description: Missing or invalid credentials.
        '403':
          description: >-
            You don't have editor access to this app, or you used a workspace
            API key. A read-only personal access token is refused. Also returned
            when protection is already on or the app can't use backend
            functions, with the message `Core Integration protection is not
            available`.
        '404':
          description: App not found.
        '409':
          description: >-
            The app isn't ready for protection. The message is `Core Integration
            calls must be migrated or published before protection is enabled`
            when:

            - The app's code, or its published version, still calls a restricted
            integration directly.

            - The app isn't published, or its latest published version isn't
            live yet.

            - A change to who can open the app isn't published yet.


            The message is `App changed while Core Integration protection was
            being enabled` when the app's code changed during the call.
        '429':
          description: >-
            Rate limit exceeded. The base limit is 30 requests per minute for
            each app, shared by every personal access token in the workspace.
            See [Rate
            limits](/developers/references/apps-api/get-started/rate-limits) for
            the multiplier your plan gets.
        '503':
          description: >-
            The change couldn't be applied to the published app. Base44 tries to
            roll it back, but protection can still end up on. Try again. The
            call is refused if protection is already on.
      security:
        - PersonalAccessTokenAuth:
            - full_access
components:
  schemas:
    CoreIntegrationProtectionEnabled:
      properties:
        protected:
          type: boolean
          title: Protected
          description: Always `true`. The published app now enforces the protection.
          example: true
      type: object
      required:
        - protected
      title: CoreIntegrationProtectionEnabled
  securitySchemes:
    PersonalAccessTokenAuth:
      type: http
      scheme: bearer
      description: >-
        Personal access token, sent as `Authorization: Bearer <token>`. Each
        operation lists the permission it needs: `read_only` or `full_access`. A
        full-access token can call every operation. A read-only token can call
        only the operations that list `read_only`; anything else returns 403
        `read_only_credential_route_not_allowed`.

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.