Update feed API

Feeds are public GET routes under /feeds/v1. Use the app slug and channel name, not management IDs. The server selects a released, non-revoked artifact eligible for the channel and staged rollout. An optional X-Device-Id gives stable rollout selection and contributes a hashed device check-in; clients should persist their own stable ID. Feed requests are rate limited.

Path suffix after /feeds/v1	Format	Inputs and success
/:appSlug/:channel/:platform/:arch/latest.json	Generic signed JSON	Optional ?version=current, ?variant=; 200 JSON or 204
/:appSlug/:channel/sparkle.xml	Sparkle appcast XML	Optional `?platform=macos
/:appSlug/:channel/electron/:file	Electron updater YAML	:file selects updater target; optional ?version=current; 200 YAML or 204
/:appSlug/:channel/tauri/:target/:arch/:currentVersion	Tauri update JSON	Target, architecture, and current version in path; 200 JSON or 204
/:appSlug/:channel/:arch/app.appinstaller	MSIX App Installer XML	200 XML
/:appSlug/:channel/linux/:arch/latest.AppImage	AppImage file URL	302 to /dl/:artifactId
/:appSlug/:channel/linux/:arch/latest.AppImage.zsync	Not implemented	Always 404

Variants

Every route above except the unimplemented zsync one accepts an optional ?variant=<key> (see Build variants).

• Without it, the feed serves the platform's default variant, so existing clients and URLs are unchanged.
• An unknown key, or one scoped to another platform, returns 404.
• Selection is strict: a variant with no matching build returns 204, never another variant's file. The universal fallback applies only inside the variant.
• The generic payload includes variant for non-default variants only, so default payloads and ETags stay byte-identical. The SDK's variant option sends the parameter and rejects a signed payload for a different variant.
• Tauri targets map x86_64 to x64, aarch64 to arm64, armv7 to armv7, and i686 to x86 (falling back to x64).
• Electron adds latest-linux-arm64.yml and latest-linux-armv7l.yml.
• An MSIX App Installer keeps ?variant= in its own Uri.
• A CDN in front of the feeds must include the query string in its cache key.

platform and arch must be among the supported artifact values. Sparkle defaults to macos and universal; only platform=windows selects Windows. A missing eligible update on the first four feed formats returns 204 No Content. Feed responses use Cache-Control: public, max-age=60; successful non-Tauri feeds include an ETag. The App Installer route returns XML for an eligible artifact and the AppImage route redirects. A private or nonexistent app/channel is not exposed as an update.

curl -H "X-Device-Id: stable-device-id" \
  "$RD_URL/feeds/v1/field-notes/stable/android/arm64/latest.json?version=1.3.0"

Verify signatures using the format expected by your update client. Manage generic feed signing keys through Feed signing keys. Downloads referenced by feeds follow the download rules.