`GET /installations` — every installation held by a team the caller belongs to (ADR-0050 §6).

No team parameter, deliberately. The set is auth.team_ids, so a caller cannot name a team they are not on — the bound is the permission scope rather than an argument to be validated. A caller on two teams gets the union of both.

One synthetic page, like every list on this surface: the cost scales with the caller's team count rather than the org's install count, because there is no per-row join.

Response Body

curl -X GET "https://example.com/installations"

{  "data": [    {      "app_id": "string",      "created_at": "string",      "id": "string",      "installed_by": "string",      "team_id": "string"    }  ],  "page": 0,  "page_size": 0,  "total": 0,  "total_pages": 0}