Origin and base path
The versioned change-engine API lives at /api/v1 on your AppsCert application origin. Production uses https://appscert.com; a self-hosted installation uses its configured origin. Do not assume a separate API hostname.
Which credential?
- Human session
- Signed-in users are checked for the requested organization and read/write permission. Signing in alone does not authorize access to every organization.
- Workload token
- An opaque, short-lived bearer token from the GitHub Actions OIDC exchange. Bound to an organization, workload identity and configured scopes.
- Dashboard API key
- Used by the separate legacy CI API, including the Fastlane plugin. It is not accepted as a v1 workload token.
For a workload request, send Authorization: Bearer $WORKLOAD_TOKEN. Do not also rely on a browser session as a fallback: when a bearer is supplied, invalid workload authorization is rejected.
Scope and organization checks
- Resource reads need
change:resource:read; registration needschange:resource:write. Consumer receipts needchange:receipt. - Planning accepts
change:planor all operation scopes required by the plan. A planning scope does not authorize execution. - Executing or controlling a change requires the scopes derived from the plan's resource class and capabilities. Request only the needed scopes during onboarding.
- Workload requests must match their organization and relevant repository/environment consumer binding. A scope does not override those boundaries.
See each endpoint's authentication and scope notes in the OpenAPI reference. Never put a token in a URL, commit, log or support message. Keep the workload token in the CI job's secret handling and avoid printing exchange responses.