Private Apps
Start a chunked upload
Opens an upload session for one file and returns the chunk size, chunk count and the endpoints for the chunk PUTs, completion, status and abort. With purpose 'private_apk', completing the session reads the APK and creates the private APK content item. Without a purpose, attach the completed session to a content record with POST /api/v1/content/{id}/attach-upload.
Upload one chunk
Sends chunk n (1-based) as the raw request body with Content-Length. Content-Range (bytes start-end/total) is optional: when absent the range is derived from n, the session's chunk size and the body length, so every chunk but the last must be exactly chunk_size_bytes long; when sent it is validated against the same geometry. X-Chunk-Sha256 optionally carries the chunk's hex SHA-256. Chunks may be sent in any order and retried.
Complete a chunked upload
Assembles the uploaded chunks into one stored file. Every chunk must have arrived; GET /api/v1/uploads/{id}/status lists any that are missing. For a session opened with purpose 'private_apk' the body may be empty: the server computes the file's SHA-256, refuses it with SHA256_MISMATCH when a declared sha256 (at init or here) differs, reads the APK (APK_UNREADABLE, APK_UNSIGNED), and creates the private APK content item, returned under content. The same bytes uploaded again return the existing item with created false, and repeating the call returns the same item.
Get chunked upload status
Reports which chunks have arrived and which are missing, so an interrupted upload can resume.
Abort a chunked upload
Cancels the upload session and discards any uploaded chunks. Aborting an already cancelled session also answers 204.
List content
Lists content in the caller's enterprise. Rows whose upload was never attached (no storage_key) are excluded. Kiosk-config rows are excluded by default; pass exclude_kiosk=false to include them.
Create a content record
Creates the metadata row only. The row carries no bytes and no storage_key until an upload session is bound to it via POST /api/v1/content/{id}/attach-upload; un-attached rows are hidden from list results and reclaimed after 48h.
Get one content record
Get one content record
Update content metadata
Updates the metadata on an existing content row. For a private APK this is where the console writes the package name, version code, signing fingerprint and app label it parsed in-browser; POST /api/v1/content/{id}/attach-upload rejects the bind if any of those are still absent. Registered on both PUT and PATCH with identical behaviour.
Bind a completed upload session to a content record
Final step of the chunked upload pipeline. Stamps the session's storage_key, storage_provider, size_bytes and sha256 onto the content row and marks the session consumed, in one transaction. Idempotent for the same (session, content) pair. A private APK is rejected here unless its package name, version code, signing fingerprint and app label were already written via PUT /api/v1/content/{id}; a boot animation is rejected unless its bytes pass the archive checks Android's loader enforces silently on device; a boot logo is rejected unless it is a structurally valid MTK logo image; a row flagged is_wallpaper is rejected unless its bytes are a PNG, JPEG or WebP image.