HTTP API reference

Authentication

Send an API token as a bearer token. Create one under Settings → Developer → API tokens, with betadrop tokens create, or with POST /api/cli/tokens. The base URL is https://api.betadrop.app/api.

curl https://api.betadrop.app/api/cli/whoami \
  -H "Authorization: Bearer bd_live_xxxxxxxxxxxxxxxxxxxx"

The check is made on every route by HTTP method, so a read token cannot reach a write by any path. A missing, expired or revoked token answers 401; a valid token without the ability answers 403 — re-authenticating will not help, a different token will.

Responses, errors and limits

// success
{ "success": true, "data": { … }, "message": "optional" }

// failure — `reason` is a stable code to branch on; `error` is for people
{ "success": false, "error": "This token is not allowed to make changes. It needs the 'publish' ability.", "reason": "…" }

• Organizations. Send X-BetaDrop-Org: <organization id> to act inside an organization; a token created inside one acts there without it. Membership is checked on every request.
• Rate limits. Per route, per minute — 30 uploads, 30 inspections, 60 build lists. Over the limit answers 429.
• Uploads are multipart/form-data with the file in a part named file, up to your plan's file size limit.
• Field names follow each endpoint as listed below. Older endpoints use snake_case, newer ones camelCase; neither will be renamed under you.

Builds

curl -X POST https://api.betadrop.app/api/cli/publish \
  -H "Authorization: Bearer $BETADROP_TOKEN" \
  -F "file=@build/MyApp.ipa" \
  -F "notes=Fixes the login crash" \
  -F "expiry_type=combined" -F "expiry_time_days=14" -F "expiry_device_limit=25" \
  -F "channel=acmebeta"

Inspect a build

POST /api/inspect takes the same file part as a publish, reads it, and throws it away — nothing is stored, so a read token is enough. installableFromLink is false exactly when a check has level error. .aab files are refused with aab_not_installable: an app bundle cannot be installed from a link.

curl -X POST https://api.betadrop.app/api/inspect \
  -H "Authorization: Bearer $BETADROP_TOKEN" \
  -F "file=@build/MyApp.ipa"

{
  "success": true,
  "data": {
    "platform": "ios",
    "installableFromLink": false,
    "checks": [
      { "id": "profile_kind", "level": "error",
        "message": "Signed with an App Store profile, which installs only through the App Store or TestFlight. …" },
      { "id": "profile_expiry", "level": "ok", "message": "Profile valid until Jan 1, 2027." }
    ],
    "app": { "name": "Acme", "bundleId": "com.acme.app", "version": "2.4.0", "buildNumber": "119", … },
    "ios": { "profile": { "kind": "app-store", "teamId": "ABCDE12345", "expiresAt": "2027-01-01T00:00:00Z", … } },
    "android": null,
    "sha256": "…", "fileSize": 48213904
  }
}

Standing links and share links

The API still calls standing links channels. A standing link is one URL you point at any build; a share link is a per-build link with its own password, label and limits.

iOS devices

The UDID registry behind ad-hoc provisioning: collect devices with a link, then export them for Apple's portal or fastlane.

Webhooks

/api/webhooks — list, add, change, test, rotate the secret, read the delivery log, redeliver. Events, payloads and signature verification are on the webhooks page.

Tokens and account

Static sites