Reference

credentials

Store signing credentials: an App Store Connect key, an Android upload keystore, held by the credentials service; reads return metadata only, and every change is trust-class. Index · shared schemas · errors.

credentials.list

List an org's signing credentials, newest first: metadata only (kind, allow-lists, team and key ids, certificate serial, digests and expiry, profile UUIDs)

Input:

{ orgId: OrgId; includeDeleted?: boolean }

Output:

{ credentials: SigningCredential[] }

Errors: U, NOT_FOUND.

Named types: OrgId, SigningCredential.

credentials.get

A signing credential: metadata only

Input:

{ orgId: OrgId; credentialId: CredentialId }

Output:

{ credential: SigningCredential }

Errors: U, NOT_FOUND.

Named types: CredentialId, OrgId, SigningCredential.

credentials.uploadAscKey

Store an App Store Connect API key (its .p8 PEM, key id and issuer id) for the credentials service to provision distribution certificates and profiles with; it never leaves the service. Trust class.

Input:

{
  orgId: OrgId
  name: DisplayName
  keyId: string  // /^[A-Z0-9]{10}$/
  issuerId: string  // /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/
  privateKeyPem: string  // 1–4096 chars
  projects: CredentialProjectsIn
  sourceRefs: SourceRuleIn[]  // ≤ 16 items
  allowTarballs?: boolean
}

Output:

{ credential: SigningCredential }

Errors: U, NOT_FOUND, ORG_SUSPENDED, CONFLICT, CAPACITY_UNAVAILABLE.

Named types: CredentialProjectsIn, DisplayName, OrgId, SigningCredential, SourceRuleIn.

credentials.createAndroidKeystore

Generate an Android upload keystore in the credentials service (PKCS12, RSA 4096, 10,000 days); its key never leaves the service. Trust class.

Input:

{
  orgId: OrgId
  name: DisplayName
  commonName?: DisplayName
  projects: CredentialProjectsIn
  sourceRefs: SourceRuleIn[]  // ≤ 16 items
  allowTarballs?: boolean
}

Output:

{ credential: SigningCredential }

Errors: U, NOT_FOUND, ORG_SUSPENDED, CONFLICT, CAPACITY_UNAVAILABLE.

Named types: CredentialProjectsIn, DisplayName, OrgId, SigningCredential, SourceRuleIn.

credentials.uploadAndroidKeystore

Store an Android upload keystore you already have (PKCS12 or JKS, at most 64 KiB, with its passwords and alias); the service opens it in an isolated child, keeps it as PKCS12 and never returns it. Trust class.

Input:

{
  orgId: OrgId
  name: DisplayName
  keystoreBase64: string  // 4–87386 chars; /^[A-Za-z0-9+/]+={0,2}$/
  storePassword: string  // 1–128 chars
  keyAlias: string  // /^[A-Za-z0-9._-]{1,64}$/
  keyPassword?: string  // 1–128 chars
  projects: CredentialProjectsIn
  sourceRefs: SourceRuleIn[]  // ≤ 16 items
  allowTarballs?: boolean
}

Output:

{ credential: SigningCredential }

Errors: U, NOT_FOUND, ORG_SUSPENDED, CONFLICT, CAPACITY_UNAVAILABLE.

Named types: CredentialProjectsIn, DisplayName, OrgId, SigningCredential, SourceRuleIn.

credentials.rotate

Replace a credential's secret, keeping its id and allow-lists: a new App Store Connect key, or a new (generated or uploaded) Android upload keystore. The old secret is removed from the database; a database backup taken before still holds it, sealed, until the backup ages out. Trust class.

Input:

{
  orgId: OrgId
  credentialId: CredentialId
  ascKey?: {
    keyId: string  // /^[A-Z0-9]{10}$/
    issuerId: string  // /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/
    privateKeyPem: string  // 1–4096 chars
  }
  androidKeystore?: {
    keystoreBase64: string  // 4–87386 chars; /^[A-Za-z0-9+/]+={0,2}$/
    storePassword: string  // 1–128 chars
    keyAlias: string  // /^[A-Za-z0-9._-]{1,64}$/
    keyPassword?: string  // 1–128 chars
  }
}

Output:

{ credential: SigningCredential }

Errors: U, NOT_FOUND, ORG_SUSPENDED, CONFLICT, CAPACITY_UNAVAILABLE.

Named types: CredentialId, OrgId, SigningCredential.

credentials.updateAllowList

Set which projects and source refs may sign with a credential (re-encrypted, since both lists and the tarball opt-in are bound into the secret's additional data). Trust class.

Input:

{
  orgId: OrgId
  credentialId: CredentialId
  projects: CredentialProjectsIn
  sourceRefs: SourceRuleIn[]  // ≤ 16 items
  allowTarballs?: boolean
}

Output:

{ credential: SigningCredential }

Errors: U, NOT_FOUND, ORG_SUSPENDED, CONFLICT, CAPACITY_UNAVAILABLE.

Named types: CredentialId, CredentialProjectsIn, OrgId, SigningCredential, SourceRuleIn.

credentials.delete

Delete a credential: its secret is removed from the database (a database backup taken before still holds it, sealed, until the backup ages out) and its metadata kept as deleted (deleted: false when it already was). Builds that name it fail to sign. An iOS identity's Apple certificate is not revoked. Trust class.

Input:

{ orgId: OrgId; credentialId: CredentialId }

Output:

{ deleted: boolean }

Errors: U, NOT_FOUND, CONFLICT, CAPACITY_UNAVAILABLE.

Named types: CredentialId, OrgId.