Codemagic

Delete an OTA access key for a team via DELETE /api/v3/ota/{team_id}/access-keys/{key_id}. Over-the-air (OTA) updates are Codemagic's CodePush-successor plane: projects, deployment channels, releases and access keys.

Stop an app preview via DELETE /api/v3/previews/{preview_id}. App previews run a built app in a browser-hosted simulator. REQUIRES the team's `app_preview` subscription feature (`can_read_app_preview` / `can_start_app_preview`), which is off on this account: measured 2026-09-19 the team preview list answers 403 (delivered by Codemagic's edge as 404 application/xml, which this integration translates back).

Delete Audit Log Connector settings for the team via DELETE /api/v3/teams/{team_id}/audit-log-connector. The Audit Log Connector streams the team's audit events to the customer's own S3 bucket. REQUIRES the `can_*_audit_log_connector` team permissions, which this token's plan does not grant: measured 2026-09-19 it answers 403 (delivered by Codemagic's edge as 404 application/xml, which this integration translates back).

Revoke a team invitation via DELETE /api/v3/teams/{team_id}/invitations/{invitation_id}. Team invitations are sent by email and accepted by their code.

Remove team membership for a user via DELETE /api/v3/teams/{team_id}/memberships/{user_id}.

Cancel a team subscription via DELETE /api/v3/teams/{team_id}/subscriptions/{subscription_id}. Billing lives on the team: subscriptions, invoices, cards and the Stripe-backed customer record. Answers 202: the cancellation is accepted and processed asynchronously.

Delete tester group via DELETE /api/v3/tester-groups/{tester_group_id}. Tester groups are the distribution lists app previews and builds are shared with.

Delete contact from the tester group via DELETE /api/v3/tester-groups/{tester_group_id}/contacts/{contact_id}. Tester groups are the distribution lists app previews and builds are shared with.

Remove the authenticated user from the team via DELETE /api/v3/user/memberships/{team_id}. The token's own user leaves the team; every team-scoped tool on this connection stops working for that team afterwards.

Delete the variable group and all its variables via DELETE /api/v3/variable-groups/{variable_group_id}. Variable groups hold environment variables and secrets that builds read; a group belongs to an app or to a team. Deletes the group AND every variable in it.

Delete the variable via DELETE /api/v3/variable-groups/{variable_group_id}/variables/{variable_id}. Variable groups hold environment variables and secrets that builds read; a group belongs to an app or to a team.

List tester groups for the app via GET /api/v3/apps/{app_id}/tester-groups. Tester groups are the distribution lists app previews and builds are shared with.

List variable groups for the app via GET /api/v3/apps/{app_id}/variable-groups. Variable groups hold environment variables and secrets that builds read; a group belongs to an app or to a team.

Get build info via GET /api/v3/builds/{build_id}.

Get build actions via GET /api/v3/builds/{build_id}/actions.

Get build remote access info via GET /api/v3/builds/{build_id}/remote-access. Answers 202 while remote access is still being prepared and 410 once it has expired.

Get team invitation by code via GET /api/v3/invitations/public/{code}. Team invitations are sent by email and accepted by their code. Resolves an invitation code to the team and role it offers, before accepting it. Declared public by the contract, so no credential is needed; an unknown code answers Codemagic's not-found (200 text/html on the wire, translated to 404 here).

Get meta information via GET /api/v3/meta. Returns meta information about Codemagic, including the public IP addresses its builders use, in CIDR notation. They may change from time to time, so automation that whitelists them should re-read this regularly. No credential is needed (the contract declares the operation public, and it answers 200 with no token).

Get information about the Shorebird integration via GET /api/v3/meta/shorebird. Lists the Flutter versions the Shorebird code-push integration supports. No credential is needed (declared public; answers 200 with no token).

Get OTA account information for the authenticated user via GET /api/v3/ota. Over-the-air (OTA) updates are Codemagic's CodePush-successor plane: projects, deployment channels, releases and access keys. Measured 2026-09-19 on an account without OTA enabled: {"data":{"status":"disabled","team_id":null}}.

List OTA access keys for a team via GET /api/v3/ota/{team_id}/access-keys. Over-the-air (OTA) updates are Codemagic's CodePush-successor plane: projects, deployment channels, releases and access keys.

List OTA projects for the team via GET /api/v3/ota/{team_id}/projects. Over-the-air (OTA) updates are Codemagic's CodePush-successor plane: projects, deployment channels, releases and access keys.

Get OTA usage stats for the team via GET /api/v3/ota/{team_id}/usage. Over-the-air (OTA) updates are Codemagic's CodePush-successor plane: projects, deployment channels, releases and access keys.

Get OTA deployment release history via GET /api/v3/ota/deployments/{deployment_id}/releases. Over-the-air (OTA) updates are Codemagic's CodePush-successor plane: projects, deployment channels, releases and access keys.

Get usage stats for an OTA deployment channel via GET /api/v3/ota/deployments/{deployment_id}/usage/{metric}. Over-the-air (OTA) updates are Codemagic's CodePush-successor plane: projects, deployment channels, releases and access keys.

Get OTA project deployment keys via GET /api/v3/ota/projects/{project_id}/deployment-keys. Over-the-air (OTA) updates are Codemagic's CodePush-successor plane: projects, deployment channels, releases and access keys.

Get app preview information via GET /api/v3/previews/{preview_id}. App previews run a built app in a browser-hosted simulator. REQUIRES the team's `app_preview` subscription feature (`can_read_app_preview` / `can_start_app_preview`), which is off on this account: measured 2026-09-19 the team preview list answers 403 (delivered by Codemagic's edge as 404 application/xml, which this integration translates back).

Get a shared dashboard via GET /api/v3/shared-dashboards/{uuid}. Reads a build dashboard by its public sharing uuid. Declared public by the contract, so no credential is needed. Replaces the deprecated GET /dashboards/{uuid}, which this integration does not ship.

List shared dashboard builds via GET /api/v3/shared-dashboards/{uuid}/builds. Lists the builds a shared dashboard shows, by its public sharing uuid. Declared public by the contract, so no credential is needed. Replaces the deprecated GET /dashboards/{uuid}/builds, which this integration does not ship.

Get shared app preview information via GET /api/v3/shared-previews/{shared_preview_id}. App previews run a built app in a browser-hosted simulator. REQUIRES the team's `app_preview` subscription feature (`can_read_app_preview` / `can_start_app_preview`), which is off on this account: measured 2026-09-19 the team preview list answers 403 (delivered by Codemagic's edge as 404 application/xml, which this integration translates back). Details of a publicly shared app preview, by the id POST /previews/{preview_id}/share returned. Declared public by the contract, so no credential is needed.

Get team info via GET /api/v3/teams/{team_id}.

Get team build duration percentiles via GET /api/v3/teams/{team_id}/analytics/build-duration-percentiles. Team build analytics. REQUIRES the `can_read_analytics_dashboard` team permission, which this token's plan does not grant: measured 2026-09-19 it answers 403 (delivered by Codemagic's edge as 404 application/xml, which this integration translates back). Nothing about the credential is wrong; the team's plan is.

Get team build analytics via GET /api/v3/teams/{team_id}/analytics/builds. Team build analytics. REQUIRES the `can_read_analytics_dashboard` team permission, which this token's plan does not grant: measured 2026-09-19 it answers 403 (delivered by Codemagic's edge as 404 application/xml, which this integration translates back). Nothing about the credential is wrong; the team's plan is.

Get team builds by status via GET /api/v3/teams/{team_id}/analytics/builds-by-status. Team build analytics. REQUIRES the `can_read_analytics_dashboard` team permission, which this token's plan does not grant: measured 2026-09-19 it answers 403 (delivered by Codemagic's edge as 404 application/xml, which this integration translates back). Nothing about the credential is wrong; the team's plan is.

Get team builds by status over time via GET /api/v3/teams/{team_id}/analytics/builds-by-status-over-time. Team build analytics. REQUIRES the `can_read_analytics_dashboard` team permission, which this token's plan does not grant: measured 2026-09-19 it answers 403 (delivered by Codemagic's edge as 404 application/xml, which this integration translates back). Nothing about the credential is wrong; the team's plan is.

Get team build usage summary via GET /api/v3/teams/{team_id}/analytics/summary. Team build analytics. REQUIRES the `can_read_analytics_dashboard` team permission, which this token's plan does not grant: measured 2026-09-19 it answers 403 (delivered by Codemagic's edge as 404 application/xml, which this integration translates back). Nothing about the credential is wrong; the team's plan is.

List apps for the team via GET /api/v3/teams/{team_id}/apps. Apps are added in the Codemagic console by connecting a repository; this API lists them and cannot create one.

Download team audit log as CSV via GET /api/v3/teams/{team_id}/audit-log. The response is a CSV document, not JSON; this tool returns it as {"content_type": "text/csv", "csv": "<the file>"}. Events: app_created, app_deleted, app_repository_changed, audit_log_connector_deleted, audit_log_connector_updated, audit_log_downloaded, file_downloaded, team_deleted, team_invitation_accepted, team_invitation_revoked, team_member_invited, team_member_removed, team_member_role_changed, user_authenticated. Measured 2026-09-19: 200 text/csv with the header row `timestamp,event,user_id,user_email,ip_address,user_agent,extra`.

Get Audit Log Connector settings for the team via GET /api/v3/teams/{team_id}/audit-log-connector. The Audit Log Connector streams the team's audit events to the customer's own S3 bucket. REQUIRES the `can_*_audit_log_connector` team permissions, which this token's plan does not grant: measured 2026-09-19 it answers 403 (delivered by Codemagic's edge as 404 application/xml, which this integration translates back).

List team builds via GET /api/v3/teams/{team_id}/builds.

List team cards via GET /api/v3/teams/{team_id}/cards.

Get team customer via GET /api/v3/teams/{team_id}/customer.

List pending team invitations via GET /api/v3/teams/{team_id}/invitations. Team invitations are sent by email and accepted by their code.

List team invoices via GET /api/v3/teams/{team_id}/invoices.

List team members via GET /api/v3/teams/{team_id}/members.

List app previews for the team via GET /api/v3/teams/{team_id}/previews. App previews run a built app in a browser-hosted simulator. REQUIRES the team's `app_preview` subscription feature (`can_read_app_preview` / `can_start_app_preview`), which is off on this account: measured 2026-09-19 the team preview list answers 403 (delivered by Codemagic's edge as 404 application/xml, which this integration translates back).

List team subscriptions via GET /api/v3/teams/{team_id}/subscriptions. Billing lives on the team: subscriptions, invoices, cards and the Stripe-backed customer record.

Get subscription details via GET /api/v3/teams/{team_id}/subscriptions/{subscription_id}. Billing lives on the team: subscriptions, invoices, cards and the Stripe-backed customer record.

Get subscription invoice preview via GET /api/v3/teams/{team_id}/subscriptions/{subscription_id}/invoice-preview. Billing lives on the team: subscriptions, invoices, cards and the Stripe-backed customer record. Answers 400 'Failed to fetch upcoming invoice for this subscription' when there is no upcoming invoice to preview (measured 2026-09-19 on a trialing subscription).

List subscription invoices via GET /api/v3/teams/{team_id}/subscriptions/{subscription_id}/invoices. Billing lives on the team: subscriptions, invoices, cards and the Stripe-backed customer record.

List variable groups for the team via GET /api/v3/teams/{team_id}/variable-groups. Variable groups hold environment variables and secrets that builds read; a group belongs to an app or to a team.

Get a tester group via GET /api/v3/tester-groups/{tester_group_id}. Tester groups are the distribution lists app previews and builds are shared with.

List contacts for the tester group via GET /api/v3/tester-groups/{tester_group_id}/contacts. Tester groups are the distribution lists app previews and builds are shared with.

Get the authenticated user via GET /api/v3/user. Returns the user's id and their permissions per team, keyed by team id (plus `personal`). This is also the endpoint a pasted token is verified against when connecting.

List apps for the authenticated user via GET /api/v3/user/apps. To list the applications belonging to a team, use codemagic_get_api_v3_teams_by_team_id_apps. An account with no repository integration has no apps (measured 2026-09-19: {"data":[]}); apps are added in the Codemagic console, not over this API.

Get notifications for the authenticated user via GET /api/v3/user/notifications.

Get preferences for the authenticated user via GET /api/v3/user/preferences.

List teams for the authenticated user via GET /api/v3/user/teams.

Get the authenticated user's permissions in a team via GET /api/v3/user/teams/{team_id}/permissions. The authoritative answer to 'why did that call 403': the permissions listed here are exactly what this token may do in the team, and a name from the contract's TeamPermission enum that is missing here (measured 2026-09-19: `can_read_analytics_dashboard` and the three `*_audit_log_connector` permissions) is a plan or role limit, not a credential fault.

Get variable group information via GET /api/v3/variable-groups/{variable_group_id}. Variable groups hold environment variables and secrets that builds read; a group belongs to an app or to a team.

List variables for the group via GET /api/v3/variable-groups/{variable_group_id}/variables. Variable groups hold environment variables and secrets that builds read; a group belongs to an app or to a team.

Get a variable from the group via GET /api/v3/variable-groups/{variable_group_id}/variables/{variable_id}. Variable groups hold environment variables and secrets that builds read; a group belongs to an app or to a team.

Rename a dashboard via PATCH /api/v3/dashboards/{dashboard_id}.

Update subscription features for the team via PATCH /api/v3/subscriptions/{team_id}/features. Billing lives on the team: subscriptions, invoices, cards and the Stripe-backed customer record. Toggles subscription add-ons; `app_preview` is the feature the app preview tools require.

Update a tester group via PATCH /api/v3/tester-groups/{tester_group_id}. Tester groups are the distribution lists app previews and builds are shared with.

Change variable group name and settings via PATCH /api/v3/variable-groups/{variable_group_id}. Variable groups hold environment variables and secrets that builds read; a group belongs to an app or to a team.

Update the variable via PATCH /api/v3/variable-groups/{variable_group_id}/variables/{variable_id}. Variable groups hold environment variables and secrets that builds read; a group belongs to an app or to a team.

Create a tester group for the app via POST /api/v3/apps/{app_id}/tester-groups. Tester groups are the distribution lists app previews and builds are shared with.

Create a variable group for the app via POST /api/v3/apps/{app_id}/variable-groups. Variable groups hold environment variables and secrets that builds read; a group belongs to an app or to a team.

Start an app preview from a build via POST /api/v3/builds/{build_id}/preview. Answers 402 when the plan's maximum number of preview sessions has been reached.

Accept a team invitation via POST /api/v3/invitations/{code}/accept. Team invitations are sent by email and accepted by their code.

Create an OTA access key for a team via POST /api/v3/ota/{team_id}/access-keys. Over-the-air (OTA) updates are Codemagic's CodePush-successor plane: projects, deployment channels, releases and access keys.

Share an app preview via POST /api/v3/previews/{preview_id}/share. App previews run a built app in a browser-hosted simulator. REQUIRES the team's `app_preview` subscription feature (`can_read_app_preview` / `can_start_app_preview`), which is off on this account: measured 2026-09-19 the team preview list answers 403 (delivered by Codemagic's edge as 404 application/xml, which this integration translates back). Creates a public id that lets anyone read the preview without a credential through codemagic_get_api_v3_shared_previews_by_shared_preview_id.

Create a team invitation via POST /api/v3/teams/{team_id}/invitations. Team invitations are sent by email and accepted by their code.

Generate invoice preview for chosen line items via POST /api/v3/teams/{team_id}/invoice-preview.

Create a team subscription via POST /api/v3/teams/{team_id}/subscriptions. Billing lives on the team: subscriptions, invoices, cards and the Stripe-backed customer record. Answers 409 when a subscription already exists (re-read the team's subscriptions before retrying: an earlier attempt with the same `idempotency_key` may already have created one) and 422 when the card or promotion code is declined. DESTRUCTIVE: Creates a PAID subscription and charges the card it names; the contract's own `idempotency_key` guidance ('an earlier attempt with this key may already have created one') says a retry can bill twice.

Apply a promotion code to a subscription via POST /api/v3/teams/{team_id}/subscriptions/{subscription_id}/promotion-code. Billing lives on the team: subscriptions, invoices, cards and the Stripe-backed customer record. DESTRUCTIVE: Alters what the team is billed; a promotion code applied to the wrong subscription is not withdrawn by this API.

Create a variable group for the team via POST /api/v3/teams/{team_id}/variable-groups. Variable groups hold environment variables and secrets that builds read; a group belongs to an app or to a team.

Bulk import contacts to the tester group via POST /api/v3/tester-groups/{tester_group_id}/contacts. Tester groups are the distribution lists app previews and builds are shared with. Not designed to sync updates in real time from an external database. Contacts are skipped rather than refused when they would exceed the account limit, have an invalid email, or are on an exclusion or bounce list; answers 402 when the maximum number of contacts has been reached.

Bulk import variables to the group via POST /api/v3/variable-groups/{variable_group_id}/variables. Variable groups hold environment variables and secrets that builds read; a group belongs to an app or to a team. Creates every variable in the list at once; `secure` applies to the whole import.

Update Audit Log Connector settings for the team via PUT /api/v3/teams/{team_id}/audit-log-connector. The Audit Log Connector streams the team's audit events to the customer's own S3 bucket. REQUIRES the `can_*_audit_log_connector` team permissions, which this token's plan does not grant: measured 2026-09-19 it answers 403 (delivered by Codemagic's edge as 404 application/xml, which this integration translates back). The body carries the customer's OWN AWS access key pair for the destination bucket; they are the operation's input, not Codemagic's credential, and they will appear wherever tool arguments are recorded.

Set customer default payment method via PUT /api/v3/teams/{team_id}/customer/default-payment-method.

Update team membership for a user via PUT /api/v3/teams/{team_id}/memberships/{user_id}.

Set subscription default payment method via PUT /api/v3/teams/{team_id}/subscriptions/{subscription_id}/default-payment-method. Billing lives on the team: subscriptions, invoices, cards and the Stripe-backed customer record.