App Store Connect API and CLI automation of submission and review
Parent: Apple Platform Frontier for Mac Utilities · Published reference · snapshot 2026-10-02
↓ Facts as markdownall context files
Source-anchored research for App Store Connect API and CLI automation of submission and review. Run status: COMPLETED.
These notes link each claim to its source. Some citations identify archived research reports that are no longer hosted on this site. A published reference means the content is available; it does not certify independent review or accuracy.Read the editorial policy and follow the sources before relying on a claim.
Definitions
- asc (rorkai/App-Store-Connect-CLI) is an MIT-licensed, unofficial Go CLI: asc validate, submit, asc review status/doctor, asc status --watch; authenticates with key-id, issuer-id and private key, with --bypass-keychain for headless CI. It states it is not affiliated with Apple. (low confidence) (verified as of 2026-10-02) [source]
How it works
- Review submission via API is a three-step flow: POST /v1/reviewSubmissions (app + platform), POST /v1/reviewSubmissionItems linking the app version, then PATCH the submission with submitted=true. Order matters; out-of-order calls give 422/foreign-key errors. (medium confidence) [source]
Problems, failure modes and limitations
- API keys come in two types: Team keys (all apps, role-based, created by an Admin) and Individual keys (inherit one user's apps and roles). Individual keys cannot use Provisioning endpoints, Sales and Finance, or notaryTool. The private .p8 downloads once only; never commit it. (high confidence) [source]
- fastlane recommends a Team key (required for provisioning-related API access); credentials are key_id, issuer_id and the .p8 content, JWT duration max 1200 seconds. fastlane produce has only partial API-key support, pem is Apple ID only, precheck cannot check IAPs with API keys. (medium confidence) (verified as of 2026-10-02) [source]
- Apple rejects JWTs with lifetime over 20 minutes for most requests; responses carry an X-Rate-Limit header with an hourly rolling limit, so throttle polling and back off. (medium confidence) [source]
Facts and statements
- The older single-call /appStoreVersionSubmissions endpoint is described as gone/replaced by reviewSubmissions; Apple's own deprecation notice was not retrievable, so confirm against the OpenAPI spec. (low confidence) (verified as of 2026-10-02) [source]
- Search reports state no API exists for the App Privacy questionnaire (manual in the web UI) while age ratings are automatable via ageRatingDeclarations; treat as unverified against Apple docs. (low confidence) (verified as of 2026-10-02) [source]
- Apple's release feed lists App Store Connect API 4.5 (22 Sep 2026) as latest; 4.3.1 shipped 12 May 2026. Individual API keys reportedly landed May 2026 per search summary of a Fivetran changelog, not Apple. (low confidence) (verified as of 2026-09-22) [source]
Children
- No children recorded.