Public pages and downloads

These routes are outside the management API. Public pages and eligible public-channel artifacts need no session. Private artifacts require an organization dashboard session or a short-lived signed URL from the release download-link endpoint. A management bearer token is not checked by /dl.

Method and path	Success	Notes
GET /d/:orgSlug/:appSlug	200 HTML	Public app page; ?page=N pages through changelog entries
GET /d/:orgSlug/:appSlug/releases/:version	200 HTML	Public release page
GET /d/:orgSlug/:appSlug/logo	200 image	App logo
GET /dl/:artifactId	200, 206, or 302	Binary download, byte range, or storage redirect
GET /dl/:artifactId/manifest.plist	200 XML	iOS OTA manifest for an IPA

Page paths use slugs. Disabled public pages and releases unavailable to the public return 404. Public pages cache for 60 seconds and vary by user agent; logos cache for five minutes. The page shows eligible platform builds and may highlight the visitor's detected platform.

Downloads use artifact IDs. Local storage supports Range requests, returning 206 and Content-Range for a satisfiable byte range, or 416 for an unsatisfiable range. Redirect-capable storage may return 302 instead. Follow redirects and preserve the signed URL's exp and sig parameters for private downloads. Revoked or missing artifacts return 404; insufficient private access returns 401.

The manifest route works only for IPA artifacts with a parsed bundle identifier and an HTTPS RD_BASE_URL. It carries a valid signed link through to the IPA URL when needed. A non-IPA artifact returns 404; missing metadata or a non-HTTPS base URL returns 400.

See Update feeds for machine-readable update checks and Tester portal for private tester access.