canonical: https://jentic.com/apis/bitrise.io/bitrise

# Bitrise API

Bitrise publishes an official Swagger 2.0 specification for the Bitrise API, and this document is that specification converted to OpenAPI 3.0.1 and bundled for agent use. Bitrise is a CI/CD platform built specifically for mobile app teams. The v0.1 REST API exposes 119 endpoints covering apps, builds, workflows, generic file storage, Android keystore files, provisioning profiles, build certificates, build artifacts, addon management, archived builds, and webhooks. Authentication uses a Personal Access Token in the Authorization header for user-context calls and an addon auth token for addon-context calls.

## For AI agents

Trigger and inspect mobile CI/CD builds on Bitrise, manage signing assets, and download build artifacts. 119 endpoints with Personal Access Token authentication.

## Scope

Does not host source code, run static analysis, or distribute apps to stores - use for triggering and inspecting Bitrise builds and managing signing assets only.

## Capabilities

- Trigger a build on a registered app via the apps and builds endpoints
- Read build status and logs for a given app slug and build slug
- Upload and manage Android keystore files, iOS provisioning profiles, and build certificates
- Download build artifacts including IPAs, APKs, and dSYM bundles
- Manage addon installations on apps and inspect their state
- Register a new app on Bitrise via `/apps/register`

## Use cases

### On-demand mobile builds from chat

Mobile teams trigger Bitrise builds from a chat command rather than the Bitrise UI. The trigger endpoint accepts a workflow id and an optional branch, and Bitrise returns a build slug that the same chat session can poll for status and artifact URLs. Posting an IPA download link back into the channel takes seconds because the artifact endpoints expose direct download URLs.

Example prompt: Trigger a build on app slug abc123 with workflow 'release', poll the build status until success, and post the IPA artifact URL back to the chat

### Signing asset rotation across apps

Mobile platform teams rotate Android keystores and iOS provisioning profiles across many Bitrise apps when certificates expire. The `/apps/{app-slug}/android-keystore-files` and provisioning profile endpoints accept new uploads and mark them as the active asset, so a single script can iterate every app in the org and replace the expiring credential. The same script reads back the uploaded slug to confirm the rotation succeeded.

Example prompt: For each app in the organisation, upload the new keystore via `/apps/{app-slug}/android-keystore-files` and confirm the uploaded flag turns true

### Build artifact ingestion for release notes

Release engineering teams ingest finished Bitrise build artifacts (IPAs, APKs, dSYMs) into a release notes pipeline that maps a build to a Git commit and a feature list. The build and artifact endpoints return the metadata needed to assemble release notes without manually copying URLs out of the Bitrise UI. A nightly job covers every app slug.

Example prompt: List builds for app slug abc123 in the last 24 hours, fetch their artifacts, and write IPA URLs and commit hashes into the release-notes pipeline

### Agent integration via Jentic for mobile CI

An AI agent that needs to run a mobile build calls Jentic with the intent 'trigger a mobile ci build'. Jentic returns the Bitrise builds endpoint with its input schema (app slug, branch, workflow id), and injects the Personal Access Token at execution. The agent never holds the token, so a chat session can spin up a release build without exposing the credential.

Example prompt: Search Jentic for 'trigger a mobile ci build', load the Bitrise builds schema, and execute against the user's app slug and the 'release' workflow

## Key endpoints

| Method | Path | Description |
| --- | --- | --- |
| GET | `/apps` | List the apps the authenticated user can access |
| POST | `/apps/register` | Register a new app on Bitrise |
| GET | `/apps/{app-slug}` | Read a single app's metadata |
| GET | `/apps/{app-slug}/addons` | List addons installed on an app |
| POST | `/apps/{app-slug}/android-keystore-files` | Upload a new Android keystore to an app |
| GET | `/apps/{app-slug}/archived-builds` | List archived builds for an app |
| GET | `/addons` | List available addons |

## Key resources

- **Apps** — Register, list, and manage Bitrise apps including their settings and integrations
- **Builds** — Trigger, list, abort, and inspect builds and their logs
- **Build Artifacts** — List and download artifacts produced by finished builds (IPAs, APKs, dSYMs)
- **Android Keystore Files** — Upload, list, and manage Android signing keystores attached to an app
- **Provisioning Profiles** — Upload and manage iOS provisioning profiles attached to an app
- **Build Certificates** — Upload and manage iOS build certificates attached to an app
- **Addons** — List and manage addons installed on an app

## Why Jentic

- **Setup:** Wiring the Bitrise API by hand means setting the personal-access or addon token header, targeting the api.bitrise.io/v0.1 host, and handling retries across build and signing-asset calls yourself. Through Jentic you install once, import Bitrise from the API Directory, store the token once, and your agent calls it.
- **Permission scoping:** Bitrise puts the app slug in the URL path (`/apps/{app-slug}/...`), so a rule can pin your agent to one app: it can read that app's addons and archived builds and nothing else. You choose the operations it may call, so uploads like POST `/apps/{app-slug}/android-keystore-files` are not included unless you add them.
- **Credential handling:** Your Bitrise personal-access or addon token is stored once, encrypted, by your own Jentic One instance and injected into the correct header at execution time. It never enters the agent's prompt, logs, or context.
- **Discovery method:** Agents search Jentic by intent such as 'trigger a mobile CI build' or 'list Bitrise apps', and Jentic returns the matching v0.1 operation with its input and response schema so the agent calls the right endpoint without browsing the reference docs.

## Related APIs

- **CircleCI API** — General-purpose CI/CD platform with REST API for triggering and inspecting workflows.
- **Buddy** — CI/CD platform with REST API and visual pipelines.
- **GitHub API** — Source control and Actions surface that commonly triggers Bitrise builds upstream.

## FAQ

### Does Bitrise publish an official OpenAPI specification?

Yes. Bitrise publishes an official Swagger 2.0 specification at https://api-docs.bitrise.io/docs/swagger.json, rendered as a Swagger UI reference at https://api-docs.bitrise.io/. The document behind this page is that specification converted to OpenAPI 3.0.1 and bundled, so it carries Bitrise's own info block, both security schemes (PersonalAccessToken and AddonAuthToken), and 119 of the official document's 120 operations. The official document additionally exposes one build AI-summary operation that this conversion does not yet include. Get started with Jentic One, the self-hosted execution layer.

### What authentication does the Bitrise API use?

User-context calls authenticate with a Personal Access Token passed in the Authorization header. Addon-context calls use a separate Bitrise-Addon-Auth-Token header. Through Jentic the appropriate token is held encrypted in the vault and injected at call time.

### Can I trigger a build with the Bitrise API?

Yes. POST against the build trigger endpoint for an app slug with a payload that names a workflow id and a branch. Bitrise returns a build slug you can pass to `/apps/{app-slug}/builds/{build-slug}` to poll for status and artifact URLs.

### What are the rate limits for the Bitrise API?

Bitrise enforces per-token rate limits documented as 60 requests per second sustained with short bursts allowed. A 429 response indicates the limit was hit; retry with exponential backoff. Heavy artifact downloads count against the same quota as control-plane calls.

### How do I trigger a Bitrise build through Jentic?

Run pip install jentic, search Jentic for 'trigger a mobile ci build', load the Bitrise build trigger operation, and execute with the app slug, branch, and workflow id. Jentic injects the Personal Access Token automatically.

### Can I download IPA and APK artifacts via the API?

Yes. The build artifacts endpoints under `/apps/{app-slug}/builds/{build-slug}/artifacts` list each artifact and return signed download URLs. Use these URLs to fetch the IPA, APK, or dSYM bundle without going through the Bitrise UI.

### Can I limit what my agent is allowed to do with the Bitrise API?

Yes. Because Jentic One is self-hosted, your own rules decide which Bitrise operations and credentials the agent may use. Since Bitrise puts the app slug in the URL path (`/apps/{app-slug}/...`), you can pin the agent to a single app so it only reads that app's addons and archived builds, and you choose exactly which operations it may call. Write actions such as POST `/apps/{app-slug}/android-keystore-files` are excluded unless you explicitly add them.