REST API

All endpoints are under /api/v1. This page covers the public Bearer-token API for automation and server-side tooling. Requests and responses use JSON.

Authentication

Public REST requests use a Bearer token:

Bearer tokenCLI / server operations — upload, release, list. Use your organization secret key (otakit_sk_...) or a user access token from otakit login. The app ID is part of the URL path.

# CLI / server operations
Authorization: Bearer otakit_sk_...   # or OTAKIT_ACCESS_TOKEN

Apps

POST/api/v1/apps

Create a new app. The slug should match your Capacitor app identifier. Returns an appId for plugin and CLI usage.

Auth: Bearer

Request body

{ "slug": "com.example.myapp" }

Response

{
  "id": "uuid",
  "slug": "com.example.myapp",
  "createdAt": "ISO timestamp"
}

Bundles

POST/api/v1/apps/:appId/bundles/initiate

Start a bundle upload session. Returns a presigned PUT URL. Upload your zip file to this URL with Content-Type: application/zip.

Auth: Bearer

Request body

{
  "version": "1.0.1",       // semver string
  "size": 1048576,          // bundle size in bytes
  "sha256": "64-char hex checksum of the zip file",
  "minNativeBuild": 100     // optional
}

Response

{
  "uploadId": "uuid",
  "presignedUrl": "https://...",
  "storageKey": "...",
  "expiresAt": "ISO timestamp"
}

POST/api/v1/apps/:appId/bundles/finalize

Finalize a bundle upload session. The server checks that the uploaded object exists and that its size matches the initiated session, then creates the bundle record from the stored session data.

Auth: Bearer

Request body

{
  "uploadId": "uuid"
}

Response

{
  "id": "uuid",
  "version": "1.0.1",
  "sha256": "...",
  "size": 1048576,
  "minNativeBuild": null,
  "createdAt": "ISO timestamp"
}

GET/api/v1/apps/:appId/bundles

List bundles sorted by creation date (newest first).

Auth: Bearer · Query: ?limit=20&offset=0

Response

{
  "bundles": [{ id, version, sha256, size, createdAt }],
  "total": 42
}

DELETE/api/v1/apps/:appId/bundles/:bundleId

Delete a bundle. Bundles that are part of a release history cannot be deleted.

Auth: Bearer

Response

{ "deleted": true, "id": "uuid" }

Releases

POST/api/v1/apps/:appId/releases

Release a bundle to the base channel or a named channel. One bundle = one release event.

Auth: Bearer

Request body

{
  "bundleId": "uuid",
  "channel": "staging"   // optional; omit or null for base channel
}

Response

{
  "release": {
    "id": "uuid",
    "channel": null,
    "bundleId": "uuid",
    "bundleVersion": "1.0.1",
    "promotedAt": "ISO timestamp"
  },
  "previousRelease": { ... } | null
}

GET/api/v1/apps/:appId/releases

List release history sorted newest first. Omit channel to list every stream, or pass an empty channel value to query only the base channel.

Auth: Bearer · Query: ?channel=staging&limit=20&offset=0

Response

{
  "releases": [{
    id, channel, bundleId, bundleVersion, promotedAt
  }],
  "total": 12
}