Private Apps
Create a content record
Creates the metadata row only. The row carries no bytes and no storage_key until an upload session is bound to it via POST /api/v1/content/{id}/attach-upload; un-attached rows are hidden from list results and reclaimed after 48h.
List content
Lists content in the caller's enterprise. Rows whose upload was never attached (no storage_key) are excluded. Kiosk-config rows are excluded by default; pass exclude_kiosk=false to include them.
Update content metadata
Updates the metadata on an existing content row. For a private APK this is where the console writes the package name, version code, signing fingerprint and app label it parsed in-browser; POST /api/v1/content/{id}/attach-upload rejects the bind if any of those are still absent. Registered on both PUT and PATCH with identical behaviour.
Get one content record
Get one content record
Start a chunked upload
Opens an upload session for one file and returns the chunk size, chunk count and the endpoints for the chunk PUTs, completion, status and abort. Upload a private APK this way, then attach the completed session to a content record with POST /api/v1/content/{id}/attach-upload.
Upload one chunk
Sends chunk n (1-based) as the raw request body, with Content-Range: bytes start-end/total and Content-Length. X-Chunk-Sha256 optionally carries the chunk's hex SHA-256. Chunks may be sent in any order and retried.
Complete a chunked upload
Assembles the uploaded chunks into one stored file. Every chunk must have arrived; GET /api/v1/uploads/{id}/status lists any that are missing.
Get chunked upload status
Reports which chunks have arrived and which are missing, so an interrupted upload can resume.
Abort a chunked upload
Cancels the upload session and discards any uploaded chunks. Aborting an already cancelled session also answers 204.
Bind a completed upload session to a content record
Final step of the chunked upload pipeline. Stamps the session's storage_key, storage_provider, size_bytes and sha256 onto the content row and marks the session consumed, in one transaction. Idempotent for the same (session, content) pair. A private APK is rejected here unless its package name, version code, signing fingerprint and app label were already written via PUT /api/v1/content/{id}; a boot animation is rejected unless its bytes pass the archive checks Android's loader enforces silently on device; a boot logo is rejected unless it is a structurally valid MTK logo image; a row flagged is_wallpaper is rejected unless its bytes are a PNG, JPEG or WebP image.