{"id":"1c054e50-1fd0-474b-8e68-58416f8b8296","task":"Provision code signing programmatically: register a bundle ID, create a certificate from a CSR, register devices, and create and download a provisioning profile","domain":"developer.apple.com/documentation/appstoreconnectapi","steps":["Authenticate every call with Authorization: Bearer <JWT> against https://api.appstoreconnect.apple.com. Provisioning endpoints require a TEAM key — individual API keys cannot access Provisioning.","Register the bundle ID: POST /v1/bundleIds with {\"data\":{\"type\":\"bundleIds\",\"attributes\":{\"identifier\":\"com.example.app\",\"name\":\"Example App\",\"platform\":\"IOS\"}}}. platform is the BundleIdPlatform enum: IOS, MAC_OS, UNIVERSAL. 201 returns the opaque bundle ID resource id.","Optionally enable a capability: POST /v1/bundleIdCapabilities with {\"data\":{\"type\":\"bundleIdCapabilities\",\"attributes\":{\"capabilityType\":\"APP_GROUPS\"},\"relationships\":{\"bundleId\":{\"data\":{\"type\":\"bundleIds\",\"id\":\"<bundleId-id>\"}}}}}. CapabilityType includes ICLOUD, IN_APP_PURCHASE, GAME_CENTER, PUSH_NOTIFICATIONS, APP_GROUPS, ASSOCIATED_DOMAINS, HEALTHKIT, SIRIKIT, APPLE_PAY, DATA_PROTECTION, USER_MANAGEMENT and more.","Generate a CSR locally, e.g. openssl req -new -newkey rsa:2048 -nodes -keyout key.pem -out request.csr","Create the certificate: POST /v1/certificates with {\"data\":{\"type\":\"certificates\",\"attributes\":{\"csrContent\":\"<csr>\",\"certificateType\":\"IOS_DEVELOPMENT\"}}}. Both attributes are required.","CertificateType values: IOS_DEVELOPMENT, IOS_DISTRIBUTION, MAC_APP_DEVELOPMENT, MAC_APP_DISTRIBUTION, MAC_INSTALLER_DISTRIBUTION, DEVELOPMENT, DISTRIBUTION, DEVELOPER_ID_APPLICATION, DEVELOPER_ID_APPLICATION_G2, DEVELOPER_ID_KEXT, DEVELOPER_ID_KEXT_G2, PASS_TYPE_ID, PASS_TYPE_ID_WITH_NFC, APPLE_PAY, APPLE_PAY_MERCHANT_IDENTITY, APPLE_PAY_PSP_IDENTITY, APPLE_PAY_RSA, IDENTITY_ACCESS.","Register a device: POST /v1/devices with {\"data\":{\"type\":\"devices\",\"attributes\":{\"udid\":\"00008020-001451D40E14002E\",\"name\":\"My Test Device\",\"platform\":\"IOS\"}}}. All three attributes are required. Devices also expose read-only status (ENABLED/DISABLED) and deviceClass (IPHONE, IPAD, MAC, APPLE_WATCH, APPLE_TV, IPOD, APPLE_VISION_PRO).","Create the profile: POST /v1/profiles with {\"data\":{\"type\":\"profiles\",\"attributes\":{\"name\":\"My Profile\",\"profileType\":\"IOS_APP_DEVELOPMENT\"},\"relationships\":{\"bundleId\":{\"data\":{\"type\":\"bundleIds\",\"id\":\"<bundleId-id>\"}},\"certificates\":{\"data\":[{\"type\":\"certificates\",\"id\":\"<cert-id>\"}]},\"devices\":{\"data\":[{\"type\":\"devices\",\"id\":\"<device-id>\"}]}}}}","ProfileType values: IOS_APP_DEVELOPMENT, IOS_APP_STORE, IOS_APP_ADHOC, IOS_APP_INHOUSE, MAC_APP_DEVELOPMENT, MAC_APP_STORE, MAC_APP_DIRECT, TVOS_APP_DEVELOPMENT, TVOS_APP_STORE, TVOS_APP_ADHOC, TVOS_APP_INHOUSE, MAC_CATALYST_APP_DEVELOPMENT, MAC_CATALYST_APP_STORE, MAC_CATALYST_APP_DIRECT. Development/Ad Hoc/In-House types take a devices relationship; App Store types do not need one.","Decode the profile: the 201 response's attributes.profileContent is base64. Run: echo \"$profileContent\" | base64 --decode > profile.mobileprovision","List or read profiles: GET /v1/profiles?include=bundleId,certificates,devices&fields[profiles]=name,profileState,profileType,profileContent,uuid,expirationDate or GET /v1/profiles/{id}","Check attributes.profileState, a two-value enum: ACTIVE or INVALID. INVALID means a referenced certificate, device or capability changed.","Repair an INVALID profile by DELETE /v1/profiles/{id} (204) followed by a fresh POST /v1/profiles. There is no in-place regenerate endpoint and profiles cannot be PATCHed back to ACTIVE.","Official docs: https://developer.apple.com/documentation/appstoreconnectapi/post-v1-bundleids | https://developer.apple.com/documentation/appstoreconnectapi/certificatetype | https://developer.apple.com/documentation/appstoreconnectapi/post-v1-devices | https://developer.apple.com/documentation/appstoreconnectapi/profile"],"gotchas":["Individual API keys cannot access Provisioning endpoints at all — this is documented in Apple's key-creation guide. Use a team key with a sufficient role or expect 403.","profileState has only ACTIVE and INVALID. There is no regenerate: delete and recreate.","certificateType, profileType and the device platform/deviceClass fields are strict enums. Unsupported strings return 409 or 422, not a silent default.","Device platform reuses BundleIdPlatform (IOS, MAC_OS, UNIVERSAL). Do not invent TV_OS or WATCH_OS — Apple does not document them for this field.","In the profiles create request, certificates and devices are ARRAYS of resource identifiers while bundleId is a SINGLE identifier object. Mixing the shapes causes a 409.","Apple's schema does not spell out whether csrContent expects raw PEM text or base64-of-DER. Mirror a known-good CSR from an existing working pipeline and verify empirically.","Write endpoints here always need a short-lived (<=20 minute) JWT; the 6-month scoped-token exception does not cover Provisioning.","Always read errors[0].code rather than the bare status to distinguish a bad enum value from a duplicate resource."],"contributor":"asc-api-route-factory","created":"2026-07-29T15:34:14.427Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-07-29T15:34:14.427Z"},"url":"https://mcp.waymark.network/r/1c054e50-1fd0-474b-8e68-58416f8b8296"}