Code Signing API | FlightStack

Code Signing API

Code-signing material lives in a single vault, scoped to an organization (or a single repository). Builds reference credentials by ID — the agent fetches the actual material at execution time via the agent credentials endpoint.

All endpoints under /codesigning.

Common

Method	Path	Purpose
GET	`/codesigning/credentials`	List credentials. Filters: `orgId=`, `repoId=`, `type=`.
GET	`/codesigning/credentials/{id}`	Get a credential’s metadata (never the raw material).
PUT	`/codesigning/credentials/{id}`	Update metadata: name, description, isActive, expiresAt, teamId, projectId, makeOrgLevel.
DELETE	`/codesigning/credentials/{id}`	Delete a credential.

The type filter accepts: androidKeystore, iosCertificate, iosProvisioningProfile, appStoreConnectKey, playStoreServiceAccount, firebaseAndroidConfig, firebaseIosConfig, firebaseServiceAccount.

Upload endpoints

Every upload endpoint is multipart/form-data — the file goes in the part named after the material type. Metadata fields are sent as form fields alongside.

Method	Path	Material
POST	`/codesigning/android/keystore`	Android `.jks` / `.keystore`
POST	`/codesigning/ios/certificate`	iOS `.p12`
POST	`/codesigning/ios/provisioning-profile`	iOS `.mobileprovision`
POST	`/codesigning/appstore/api-key`	App Store Connect API key `.p8`
POST	`/codesigning/playstore/service-account`	Google Play service-account `.json`
POST	`/codesigning/firebase/android-config`	`google-services.json`
POST	`/codesigning/firebase/ios-config`	`GoogleService-Info.plist`
POST	`/codesigning/firebase/service-account`	Firebase service-account `.json`

Example: Android keystore

curl -X POST https://api.flightstack.voostack.com/codesigning/android/keystore \
  -H "Authorization: Bearer $TOKEN" \
  -H "X-Organization-Id: $ORG_ID" \
  -F "name=Acme Release Keystore" \
  -F "keystorePassword=supersecret" \
  -F "keyAlias=upload" \
  -F "keyPassword=supersecret" \
  -F "keystore=@release.keystore"

Example: App Store Connect API key

curl -X POST https://api.flightstack.voostack.com/codesigning/appstore/api-key \
  -H "Authorization: Bearer $TOKEN" \
  -H "X-Organization-Id: $ORG_ID" \
  -F "name=Acme App Store Connect" \
  -F "apiKeyId=AB12CD34EF" \
  -F "issuerId=1234abcd-..." \
  -F "privateKey=@AuthKey_AB12CD34EF.p8"

Using a credential in a build

Reference the credential by ID in the signing block on POST /build:

{
  "platform": "ios",
  "signing": {
    "iosCredentialId": "...",
    "appStoreConnectKeyId": "..."
  }
}

The agent fetches the material via GET /buildagent/{id}/jobs/{jobId}/credentials over Agent-Token auth. Raw material never leaves the agent disk, and is wiped after the job completes.

Permissions

Field	Effect
`repoId`	Credential is scoped to one repository.
`orgId`	Credential is scoped to one organization (any repo in that org).
`makeOrgLevel`	When `true`, promotes a repo-scoped credential to the org level.
`isActive`	Disable without deleting. Builds that reference it fail fast.
`expiresAt`	Server warns when within 30 days; rejects when past.