canonical: https://jentic.com/apis/googleapis.com/digitalassetlinks

# Google Digital Asset Links API

Google Digital Asset Links lets web and mobile owners declare verifiable relationships between online assets - for example, that an Android app is the official companion to a website. Apps and platforms use the API to check whether a given source asset (a website) has authorized a target asset (an Android app) for actions like Smart Lock for Passwords, App Links, and Chrome Custom Tabs verification. The lookups are unauthenticated GETs over public statement files (assetlinks.json) hosted on the source asset.

## For AI agents

Verify ownership and trust relationships between websites and Android apps so platforms can grant cross-asset capabilities.

## Scope

Does not handle iOS Universal Links, runtime device attestation, or in-app authentication - use for declarative website-to-Android-app trust verification only.

## Capabilities

- Check whether a source website has authorized a target Android app for a given relation
- Bulk-check multiple asset link statements in one request
- List all statements published by a source asset
- Verify Android App Links host attestation programmatically
- Validate Smart Lock for Passwords cross-app credential sharing

## Use cases

### Android App Links Verification

Mobile teams use the assetlinks:check endpoint to confirm that the assetlinks.json hosted at a domain authorizes their app's package name and signing certificate for the delegate_permission/common.handle_all_urls relation. This is the same check Android performs at install time - running it in CI catches misconfigured asset link files before release.

Example prompt: Call assetlinks:check with source website https://example.com, target android_app com.example.app with sha256_cert_fingerprint, and relation delegate_permission/common.handle_all_urls.

### Smart Lock Credential Sharing Audit

Identity teams use bulkCheck to audit which apps are entitled to share credentials with a website via the delegate_permission/common.get_login_creds relation. Running this nightly surfaces accidental authorizations or removed apps, supporting password-manager and SSO compliance.

Example prompt: Call assetlinks:bulkCheck with three target Android apps and the get_login_creds relation against source https://example.com, then return only those that fail the check.

### Statement Discovery and Reporting

Use statements:list to enumerate every relation a source asset has declared. Useful for security reviews of acquired domains - surface every Android app, iOS bundle, or web origin a domain currently trusts, and feed the list into change-management.

Example prompt: Call statements:list for source https://example.com and return every target asset and relation declared in its assetlinks.json.

### Agent-Driven App Trust Verification

Through Jentic, an AI agent verifies whether a website trusts a candidate Android app before recommending an integration path. The agent calls assetlinks:check with the package name and certificate fingerprint, returning a clean verified or not-verified outcome to the user without needing OAuth credentials (this API requires none).

Example prompt: Use Jentic to search 'check digital asset link', load the assetlinks:check schema, and execute it for source https://acme.com and target Android app com.acme.checkout.

## Key endpoints

| Method | Path | Description |
| --- | --- | --- |
| GET | /v1/assetlinks:check | Check a single asset link statement |
| POST | /v1/assetlinks:bulkCheck | Check multiple asset link statements in one call |
| GET | /v1/statements:list | List all statements published by a source asset |

## Key resources

- **assetlinks** — Check single or bulk asset link statements between source and target assets
- **statements** — List all statements declared by a source asset

## Why Jentic

- **Setup:** Wiring the Digital Asset Links API by hand means handling its public unauthenticated calls against digitalassetlinks.googleapis.com and assembling the statement-check requests yourself for website-to-app trust verification. Through Jentic you install once, import the Digital Asset Links API from the API Directory, and your agent calls it without extra plumbing.
- **Permission scoping:** This API sends its source and target assets in the request, so scope by operations: limit the agent to the operations it needs, such as checking a single link or listing statements, and leave the bulk check out unless it needs it. You choose the operations it may call, so it runs only the checks you name.
- **Credential handling:** The Digital Asset Links API needs no credential, so there is nothing to store. Requests run through your own Jentic One instance, and no secret enters the agent's prompt, logs, or context.
- **Discovery method:** Agents search Jentic by intent such as 'verify a website-to-app link' or 'list asset link statements', and Jentic returns the matching Digital Asset Links operation with its input schema so the agent calls the right endpoint without browsing the reference docs.

## Related APIs

- **Identity and Access Management (IAM) API** — Manages Google Cloud principal-level permissions - a different layer from cross-asset trust
- **Cloud Identity-Aware Proxy (IAP) API** — User identity gating for web apps, complementary to asset link verification
- **Play Integrity API** — Verify app and device integrity at runtime - different from declarative asset links

## FAQ

### What authentication does the Digital Asset Links API use?

None. The check, bulkCheck, and list endpoints are unauthenticated GETs that read public assetlinks.json files hosted by source assets. Through Jentic, no credentials are needed and nothing sensitive is exchanged.

### Can I check Android App Links with this API?

Yes. Call /v1/assetlinks:check with the source web asset, target android_app (package_name plus sha256_cert_fingerprints), and relation delegate_permission/common.handle_all_urls - this is the same verification Android performs at install time.

### What are the rate limits for the Digital Asset Links API?

Google publishes a default of around 10,000 requests per day per project for this API, with no documented per-second cap. Quota can be raised in the Google Cloud Console if your verification volume exceeds the default.

### How do I list all statements for a domain through Jentic?

Search 'list digital asset link statements', load the schema for /v1/statements:list, then execute it with source.web.site set to https://example.com. Jentic returns the parsed statement list.

### Does the Digital Asset Links API support iOS app verification?

The statement model supports web and android_app target asset types but does not validate iOS Universal Links - Apple uses its own apple-app-site-association format. Use this API for Android and web cross-asset trust only.

### Why does my check fail when the assetlinks.json looks correct?

Common causes: missing or misordered SHA-256 cert fingerprints (must match the signing cert exactly, uppercase hex with colons), incorrect Content-Type on the file (must be application/json), or HTTP redirects on the .well-known path. Fix the source file and retry the check.

### Can I limit what my agent is allowed to do with the Digital Asset Links API?

Yes. Because you run Jentic One yourself, your own rules decide which operations the agent may call, so you can scope it to only what it needs. This API's operations are assetlinks:check for a single link, assetlinks:bulkCheck for many at once, and statements:list to enumerate a source asset's declarations; you can allow just the single check and statement listing while withholding bulkCheck unless the agent truly needs it. Since the source and target assets travel in the request and the API needs no credential, the operations you name are the only checks the agent can run.