API Reference
REST endpoints, schemas and webhooks. The raw OpenAPI spec lives at /openapi.yaml.
Releases
List releasesgetNewest first, paginated.Publish a releasepostCreates an immutable release on a channel. Artifacts point at your
existing storage. Duplicate app+channel+version returns `409`.
GitHub release webhook (inbound)WebhookRelayer receives GitHub `release` events at
`/wh/github/{appId}` (URL + secret shown when you enable the
integration in app settings). Payloads are HMAC-SHA-256 verified.
Published releases land on `stable`, pre-releases on `beta`,
drafts are ignored, assets are classified per platform/arch by
filename, and checksum/metadata files are filtered out.
Apps
Push Mode
Report fleet statepostA heartbeat on devices' behalf. Devices are upserted on
`(app, deviceId)` and appear in the fleet dashboard, adoption
charts and live feed exactly as if they had checked in themselves.
Up to 500 devices per call.
Plan an update wavepostOne decision per device, using the exact same rollout logic as
`GET /u/`: version comparison, sticky staged-rollout cohorts with
fall-through, artifact matching and channel policy. Up to 500
devices per call, one rate-limit hit.
`dryRun: true` plans without writing telemetry (no device upserts,
no check-ins).
Device Endpoints
Device update checkgetThe entire client contract. `200` returns an update manifest,
`204` means up to date or not in the current rollout cohort.
Every check doubles as the heartbeat behind the fleet dashboard.
This endpoint **is** Tauri's dynamic-updater contract.
Electron update feedgetelectron-builder generic-provider feed. `file` is `latest.yml`,
`latest-mac.yml` or `latest-linux.yml`. Point
`publish.provider: generic` at `/e/{appRef}/{channel}`.
Release-notes feed (RSS)getThe release-notes feed as RSS 2.0. Subscribe to an app's changelog
from any feed reader or a Slack RSS integration. Same data as the
JSON feed. No auth, CORS-open, cached 60s.
Release-notes feedgetPublished releases, newest first, with version, markdown notes,
date and artifacts. No auth, CORS-open, cached 60s. Built for
"What's new" screens and public changelogs.
Machine-readable spec: /openapi.yaml