Provision code signing programmatically: register a bundle ID, create a certificate from a CSR, register devices, and create and download a provisioning profile

Documented steps

1. Authenticate every call with Authorization: Bearer <JWT> against https://api.appstoreconnect.apple.com. Provisioning endpoints require a TEAM key — individual API keys cannot access Provisioning.
2. Register the bundle ID: POST /v1/bundleIds with {"data":{"type":"bundleIds","attributes":{"identifier":"com.example.app","name":"Example App","platform":"IOS"}}}. platform is the BundleIdPlatform enum: IOS, MAC_OS, UNIVERSAL. 201 returns the opaque bundle ID resource id.
3. Optionally enable a capability: POST /v1/bundleIdCapabilities with {"data":{"type":"bundleIdCapabilities","attributes":{"capabilityType":"APP_GROUPS"},"relationships":{"bundleId":{"data":{"type":"bundleIds","id":"<bundleId-id>"}}}}}. CapabilityType includes ICLOUD, IN_APP_PURCHASE, GAME_CENTER, PUSH_NOTIFICATIONS, APP_GROUPS, ASSOCIATED_DOMAINS, HEALTHKIT, SIRIKIT, APPLE_PAY, DATA_PROTECTION, USER_MANAGEMENT and more.
4. Generate a CSR locally, e.g. openssl req -new -newkey rsa:2048 -nodes -keyout key.pem -out request.csr
5. Create the certificate: POST /v1/certificates with {"data":{"type":"certificates","attributes":{"csrContent":"<csr>","certificateType":"IOS_DEVELOPMENT"}}}. Both attributes are required.
6. CertificateType values: IOS_DEVELOPMENT, IOS_DISTRIBUTION, MAC_APP_DEVELOPMENT, MAC_APP_DISTRIBUTION, MAC_INSTALLER_DISTRIBUTION, DEVELOPMENT, DISTRIBUTION, DEVELOPER_ID_APPLICATION, DEVELOPER_ID_APPLICATION_G2, DEVELOPER_ID_KEXT, DEVELOPER_ID_KEXT_G2, PASS_TYPE_ID, PASS_TYPE_ID_WITH_NFC, APPLE_PAY, APPLE_PAY_MERCHANT_IDENTITY, APPLE_PAY_PSP_IDENTITY, APPLE_PAY_RSA, IDENTITY_ACCESS.
7. Register a device: POST /v1/devices with {"data":{"type":"devices","attributes":{"udid":"00008020-001451D40E14002E","name":"My Test Device","platform":"IOS"}}}. All three attributes are required. Devices also expose read-only status (ENABLED/DISABLED) and deviceClass (IPHONE, IPAD, MAC, APPLE_WATCH, APPLE_TV, IPOD, APPLE_VISION_PRO).
8. Create the profile: POST /v1/profiles with {"data":{"type":"profiles","attributes":{"name":"My Profile","profileType":"IOS_APP_DEVELOPMENT"},"relationships":{"bundleId":{"data":{"type":"bundleIds","id":"<bundleId-id>"}},"certificates":{"data":[{"type":"certificates","id":"<cert-id>"}]},"devices":{"data":[{"type":"devices","id":"<device-id>"}]}}}}
9. ProfileType values: IOS_APP_DEVELOPMENT, IOS_APP_STORE, IOS_APP_ADHOC, IOS_APP_INHOUSE, MAC_APP_DEVELOPMENT, MAC_APP_STORE, MAC_APP_DIRECT, TVOS_APP_DEVELOPMENT, TVOS_APP_STORE, TVOS_APP_ADHOC, TVOS_APP_INHOUSE, MAC_CATALYST_APP_DEVELOPMENT, MAC_CATALYST_APP_STORE, MAC_CATALYST_APP_DIRECT. Development/Ad Hoc/In-House types take a devices relationship; App Store types do not need one.
10. Decode the profile: the 201 response's attributes.profileContent is base64. Run: echo "$profileContent" | base64 --decode > profile.mobileprovision
11. List or read profiles: GET /v1/profiles?include=bundleId,certificates,devices&fields[profiles]=name,profileState,profileType,profileContent,uuid,expirationDate or GET /v1/profiles/{id}
12. Check attributes.profileState, a two-value enum: ACTIVE or INVALID. INVALID means a referenced certificate, device or capability changed.
13. Repair an INVALID profile by DELETE /v1/profiles/{id} (204) followed by a fresh POST /v1/profiles. There is no in-place regenerate endpoint and profiles cannot be PATCHed back to ACTIVE.
14. Official docs: https://developer.apple.com/documentation/appstoreconnectapi/post-v1-bundleids | https://developer.apple.com/documentation/appstoreconnectapi/certificatetype | https://developer.apple.com/documentation/appstoreconnectapi/post-v1-devices | https://developer.apple.com/documentation/appstoreconnectapi/profile