<!-- llms-explorer concept facts · https://llms-explorer.com/tree/app-store-connect-api-and-cli-automation-of-submission-and-review/ · pack 2026-10-02 · ~853 tokens -->

# App Store Connect API and CLI automation of submission and review

> Source-anchored research for App Store Connect API and CLI automation of submission and review. Run status: COMPLETED.

Parent: [Apple Platform Frontier for Mac Utilities](https://llms-explorer.com/tree/apple-platform-frontier-for-mac-utilities/) · 4 facets · 8 facts · page: https://llms-explorer.com/tree/app-store-connect-api-and-cli-automation-of-submission-and-review/

## Definitions

- asc (rorkai/App-Store-Connect-CLI) is an MIT-licensed, unofficial Go CLI: asc validate, submit, asc review status/doctor, asc status --watch; authenticates with key-id, issuer-id and private key, with --bypass-keychain for headless CI. It states it is not affiliated with Apple. (low confidence) (verified as of 2026-10-02) — [source](https://github.com/rorkai/App-Store-Connect-CLI)

## How it works

- Review submission via API is a three-step flow: POST /v1/reviewSubmissions (app + platform), POST /v1/reviewSubmissionItems linking the app version, then PATCH the submission with submitted=true. Order matters; out-of-order calls give 422/foreign-key errors. (medium confidence) — [source](https://dev.to/snake_sun/the-asc-apis-3-step-review-submission-flow-and-why-appstoreversionsubmissions-is-gone-24ld)

## Problems, failure modes and limitations

- API keys come in two types: Team keys (all apps, role-based, created by an Admin) and Individual keys (inherit one user's apps and roles). Individual keys cannot use Provisioning endpoints, Sales and Finance, or notaryTool. The private .p8 downloads once only; never commit it. (high confidence) — [source](https://developer.apple.com/documentation/appstoreconnectapi/creating-api-keys-for-app-store-connect-api.md)
- fastlane recommends a Team key (required for provisioning-related API access); credentials are key_id, issuer_id and the .p8 content, JWT duration max 1200 seconds. fastlane produce has only partial API-key support, pem is Apple ID only, precheck cannot check IAPs with API keys. (medium confidence) (verified as of 2026-10-02) — [source](https://docs.fastlane.tools/app-store-connect-api/)
- Apple rejects JWTs with lifetime over 20 minutes for most requests; responses carry an X-Rate-Limit header with an hourly rolling limit, so throttle polling and back off. (medium confidence) — [source](https://launchbuddy.app/blog/app-store-connect-api/)

## Facts and statements

- The older single-call /appStoreVersionSubmissions endpoint is described as gone/replaced by reviewSubmissions; Apple's own deprecation notice was not retrievable, so confirm against the OpenAPI spec. (low confidence) (verified as of 2026-10-02) — [source](https://dev.to/snake_sun/the-asc-apis-3-step-review-submission-flow-and-why-appstoreversionsubmissions-is-gone-24ld)
- Search reports state no API exists for the App Privacy questionnaire (manual in the web UI) while age ratings are automatable via ageRatingDeclarations; treat as unverified against Apple docs. (low confidence) (verified as of 2026-10-02) — [source](https://launchbuddy.app/blog/app-store-connect-api/)
- Apple's release feed lists App Store Connect API 4.5 (22 Sep 2026) as latest; 4.3.1 shipped 12 May 2026. Individual API keys reportedly landed May 2026 per search summary of a Fivetran changelog, not Apple. (low confidence) (verified as of 2026-09-22) — [source](https://developer.apple.com/news/releases/?id=05122026a)