Bitrise API
Official vendor OpenAPI document · agent-readyDeveloper ToolsCi CdapiKey119 EndpointsREST
For Agents
Trigger and inspect mobile CI/CD builds on Bitrise, manage signing assets, and download build artifacts. 119 endpoints with Personal Access Token authentication.
Use for: Trigger a build on the Bitrise app with slug abc123, List the recent builds for a given app, Download the build artifact for a finished build, Upload a new Android keystore to my Bitrise app
Not supported: Does not host source code, run static analysis, or distribute apps to stores - use for triggering and inspecting Bitrise builds and managing signing assets only.
Bitrise publishes an official Swagger 2.0 specification for the Bitrise API, and this document is that specification converted to OpenAPI 3.0.1 and bundled for agent use. Bitrise is a CI/CD platform built specifically for mobile app teams. The v0.1 REST API exposes 119 endpoints covering apps, builds, workflows, generic file storage, Android keystore files, provisioning profiles, build certificates, build artifacts, addon management, archived builds, and webhooks. Authentication uses a Personal Access Token in the Authorization header for user-context calls and an addon auth token for addon-context calls.
Install Jentic One Beta
Connect the Bitrise API to your agent
Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the Bitrise API, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.
Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.
1
Step 1: Jentic One Host machine
# On the machine that will host your Jentic One instance:
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Fbitrise.io%2Fbitrise" | sh2
Step 2: Agent machine
# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Fbitrise.io%2Fbitrise" | sh
jentic register # connects your agent to your Jentic One instanceJentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.
Capabilities
What an agent can do with Bitrise API.
Trigger a build on a registered app via the apps and builds endpoints
Read build status and logs for a given app slug and build slug
Upload and manage Android keystore files, iOS provisioning profiles, and build certificates
Download build artifacts including IPAs, APKs, and dSYM bundles
Manage addon installations on apps and inspect their state
Register a new app on Bitrise via /apps/register
Use Cases
Patterns agents use Bitrise API for, with concrete tasks.
★ On-demand mobile builds from chat
Mobile teams trigger Bitrise builds from a chat command rather than the Bitrise UI. The trigger endpoint accepts a workflow id and an optional branch, and Bitrise returns a build slug that the same chat session can poll for status and artifact URLs. Posting an IPA download link back into the channel takes seconds because the artifact endpoints expose direct download URLs.
Trigger a build on app slug abc123 with workflow 'release', poll the build status until success, and post the IPA artifact URL back to the chat
Signing asset rotation across apps
Mobile platform teams rotate Android keystores and iOS provisioning profiles across many Bitrise apps when certificates expire. The /apps/{app-slug}/android-keystore-files and provisioning profile endpoints accept new uploads and mark them as the active asset, so a single script can iterate every app in the org and replace the expiring credential. The same script reads back the uploaded slug to confirm the rotation succeeded.
For each app in the organisation, upload the new keystore via /apps/{app-slug}/android-keystore-files and confirm the uploaded flag turns true
Build artifact ingestion for release notes
Release engineering teams ingest finished Bitrise build artifacts (IPAs, APKs, dSYMs) into a release notes pipeline that maps a build to a Git commit and a feature list. The build and artifact endpoints return the metadata needed to assemble release notes without manually copying URLs out of the Bitrise UI. A nightly job covers every app slug.
List builds for app slug abc123 in the last 24 hours, fetch their artifacts, and write IPA URLs and commit hashes into the release-notes pipeline
Agent integration via Jentic for mobile CI
An AI agent that needs to run a mobile build calls Jentic with the intent 'trigger a mobile ci build'. Jentic returns the Bitrise builds endpoint with its input schema (app slug, branch, workflow id), and injects the Personal Access Token at execution. The agent never holds the token, so a chat session can spin up a release build without exposing the credential.
Search Jentic for 'trigger a mobile ci build', load the Bitrise builds schema, and execute against the user's app slug and the 'release' workflow
Key Endpoints
119 endpoints — bitrise publishes an official swagger 2.
METHOD
PATH
DESCRIPTION
GET
/apps
List the apps the authenticated user can access
POST
/apps/register
Register a new app on Bitrise
GET
/apps/{app-slug}
Read a single app's metadata
GET
/apps/{app-slug}/addons
List addons installed on an app
POST
/apps/{app-slug}/android-keystore-files
Upload a new Android keystore to an app
GET
/apps/{app-slug}/archived-builds
List archived builds for an app
GET
/addons
List available addons
GET
/apps
List the apps the authenticated user can access
POST
/apps/register
Register a new app on Bitrise
GET
/apps/{app-slug}
Read a single app's metadata
GET
/apps/{app-slug}/addons
List addons installed on an app
POST
/apps/{app-slug}/android-keystore-files
Upload a new Android keystore to an app
GET
/apps/{app-slug}/archived-builds
List archived builds for an app
GET
/addons
List available addons
Why Jentic?
What agents get from Jentic-routed access to this vendor.
Setup
Wiring the Bitrise API by hand means setting the personal-access or addon token header, targeting the api.bitrise.io/v0.1 host, and handling retries across build and signing-asset calls yourself. Through Jentic you install once, import Bitrise from the API Directory, store the token once, and your agent calls it.
Permission scoping
Bitrise puts the app slug in the URL path (/apps/{app-slug}/...), so a rule can pin your agent to one app: it can read that app's addons and archived builds and nothing else. You choose the operations it may call, so uploads like POST /apps/{app-slug}/android-keystore-files are not included unless you add them.
Credential isolation
Your Bitrise personal-access or addon token is stored once, encrypted, by your own Jentic One instance and injected into the correct header at execution time. It never enters the agent's prompt, logs, or context.
Intent-based discovery
Agents search Jentic by intent such as 'trigger a mobile CI build' or 'list Bitrise apps', and Jentic returns the matching v0.1 operation with its input and response schema so the agent calls the right endpoint without browsing the reference docs.
Related APIs
Alternatives and complements available in the Jentic catalogue.
Complementary
GitHub API
Source control and Actions surface that commonly triggers Bitrise builds upstream.
Use the GitHub API alongside Bitrise when the agent must correlate a Bitrise build with the originating commit, PR, or status check.
FAQs
Specific to using Bitrise API through Jentic.
Does Bitrise publish an official OpenAPI specification?
Yes. Bitrise publishes an official Swagger 2.0 specification at https://api-docs.bitrise.io/docs/swagger.json, rendered as a Swagger UI reference at https://api-docs.bitrise.io/. The document behind this page is that specification converted to OpenAPI 3.0.1 and bundled, so it carries Bitrise's own info block, both security schemes (PersonalAccessToken and AddonAuthToken), and 119 of the official document's 120 operations. The official document additionally exposes one build AI-summary operation that this conversion does not yet include. Get started with Jentic One, the self-hosted execution layer.
What authentication does the Bitrise API use?
User-context calls authenticate with a Personal Access Token passed in the Authorization header. Addon-context calls use a separate Bitrise-Addon-Auth-Token header. Through Jentic the appropriate token is held encrypted in the vault and injected at call time.
Can I trigger a build with the Bitrise API?
Yes. POST against the build trigger endpoint for an app slug with a payload that names a workflow id and a branch. Bitrise returns a build slug you can pass to /apps/{app-slug}/builds/{build-slug} to poll for status and artifact URLs.
What are the rate limits for the Bitrise API?
Bitrise enforces per-token rate limits documented as 60 requests per second sustained with short bursts allowed. A 429 response indicates the limit was hit; retry with exponential backoff. Heavy artifact downloads count against the same quota as control-plane calls.
How do I trigger a Bitrise build through Jentic?
Run pip install jentic, search Jentic for 'trigger a mobile ci build', load the Bitrise build trigger operation, and execute with the app slug, branch, and workflow id. Jentic injects the Personal Access Token automatically.
Can I download IPA and APK artifacts via the API?
Yes. The build artifacts endpoints under /apps/{app-slug}/builds/{build-slug}/artifacts list each artifact and return signed download URLs. Use these URLs to fetch the IPA, APK, or dSYM bundle without going through the Bitrise UI.
Can I limit what my agent is allowed to do with the Bitrise API?
Yes. Because Jentic One is self-hosted, your own rules decide which Bitrise operations and credentials the agent may use. Since Bitrise puts the app slug in the URL path (/apps/{app-slug}/...), you can pin the agent to a single app so it only reads that app's addons and archived builds, and you choose exactly which operations it may call. Write actions such as POST /apps/{app-slug}/android-keystore-files are excluded unless you explicitly add them.
GET STARTED