Management API - Overview

The Management API gives trusted integrations programmatic access to AppTego Portal operations. Use it to read configuration, manage builds, query logs, administer users, and integrate tenant data into internal systems.

Use this API for administrative and reporting workflows. For the narrower CI/CD upload-status-download workflow, use the Automation API.

Base URL: https://app.apptego.com/frontend

Authentication

Most Management API endpoints require an authenticated user or API token. The API supports two authenticated request styles.

API Token

Create API tokens in the AppTego Portal under User Management -> API Tokens. API tokens require a Team or Enterprise tenant.

When you create a token, AppTego returns a token_key and token_secret. The secret is shown only once. Combine them with a colon separator, Base64-encode the result, and send it as a Bearer token.

token_key:token_secret -> Base64 encode -> Authorization: Bearer <encoded-value>

Example:

TOKEN=$(printf '%s' "$TOKEN_KEY:$TOKEN_SECRET" | base64)

curl -sS -X POST https://app.apptego.com/frontend/get_applications \
  -H "Authorization: Bearer $TOKEN" \
  -H "tenant: $TENANT_ID" \
  -H "Content-Type: application/json" \
  --data-binary '{}'

API token permissions are stored on the token as tenant-user permissions. New API tokens are created with no permissions; assign only the permissions the integration needs.

Browser Session JWT

The AppTego Portal uses Cognito browser session tokens automatically. Browser session authentication supports email/password login with MFA, Google or social login, and SAML SSO for Enterprise tenants.

Server-side integrations should use API tokens instead of browser session credentials.

Public And Special-Purpose Routes

Some routes do not use the Management API token model:

Required Headers

The tenant ID is returned by /frontend/get_tenants and is also visible in the portal tenant context.

Response Format

The API returns standard HTTP status codes. The Lambda transport body is JSON, and the JSON body is the endpoint response directly. Successful responses are not wrapped in a data object.

Success example:

{
  "applications": [
    {
      "application_id": "app-uuid-1234",
      "platform": "android"
    }
  ]
}

Permission denied:

{
  "error": "You don't have permission to do this. The 'Configuration' permission is required.",
  "permission_denied": true,
  "required_permission": "modify_configuration"
}

Plan required:

{
  "error": "API tokens require a Team or Enterprise plan"
}

Authentication failed:

{
  "error": "Authentication failed"
}

Validation error:

{
  "error": "Version is missing"
}

Server error:

{
  "error": "An internal error occurred"
}

Permissions

Tenant membership stores comma-separated internal permission keys. Public docs use the corresponding AppTego Portal labels.

Read-only endpoints that do not require a specific permission are accessible to authenticated tenant users and API tokens that belong to the tenant, subject to plan gates.

Subscription Tiers

Some endpoints are restricted by tenant plan.

Feature availability for individual controls is also governed by the tenant's current configuration options. Read the relevant options endpoint before enabling controls by API.

Operational Limits

Build upload concurrency and build quotas are plan-dependent and may be overridden by tenant-specific limits.

Quick Reference

See the detailed docs for full request and response examples:

• Configuration: read and modify security control settings.
• Applications And Builds: upload, download, and manage protected apps.
• Code Signing: manage signing keys and signing workflows.
• Users And Access: tenant membership, API tokens, automation keys, SAML SSO, and tenant settings.
• Monitoring And Logs: dashboard data, WebSocket notifications, audit logs, device logs, and App Integrity.
• Tenant And Features: certificates, custom messages, custom libraries, support, billing helpers, documents, sales contact, Tego Assistant, and AI Search.

Production Integration Checklist