​
Mobile API

Endpoints for working with mobile apps (iOS / Android). See Mobile Audits for the product-level flow.

​
Search the app stores

GET /api/mobile/search?q=com.acme&platform=android
Returns store metadata (name, developer, icon, version) for matching identifiers — used when adding a mobile app. Rate-limited to 30 requests per minute per client.

​
Upload an iOS binary

iOS audits require the actual .ipa. Request a presigned upload URL, then upload: After confirmation, the binary is available to the mobile audit pipeline.

​
Run a prescan

POST /api/apps/{id}/prescan
Returns a runId to poll via GET /api/mobile-prescan/{runId}. The prescan pulls the binary (from your uploaded .ipa for iOS, or the store for Android) and produces a static inventory — embedded endpoints, secrets, and configuration issues. Only available on mobile apps, and only for platforms with a recorded identifier. iOS additionally requires an uploaded binary.

​
Check prescan results

GET /api/mobile-prescan/{runId} Returns the prescan status and its structured findings inventory.

​
Provisioning internals

POST /api/apps/mobile-provision and the /api/internal/mobile/download-* endpoints are used by the dashboard and sandbox infrastructure — you won’t call these directly.

​
Error reference