API reference

Every endpoint, what authenticates it, and what it answers.

Authentication

Three credentials, deliberately different in what they can do:

Credential	Header	Can
CI token hst_…	Authorization: Bearer	Upload builds and OTA packages. Secret
Feedback key hsf_…	X-Hashdrop-Key	Append feedback to one app. Public
Deployment key hsd_…	query parameter	Ask for updates for one deployment. Public

The two public ones are public on purpose — they ship inside your app binary where anyone can extract them. Each can do exactly one thing and can read nothing back.

POST /api/builds

Upload a build. Multipart. Fields: file, app, channel, releaseNotes, gitCommit, gitBranch. Answers 201 with the build, or 409 for a duplicate version.

POST /api/ota/releases

Publish a JavaScript bundle. Multipart. Fields: package, app, deployment, targetBinaryVersion, description, mandatory, rollout, disabled. Answers 201 with the label and package hash.

POST /api/feedback

Record a report. JSON or multipart. Fields: message (required), kind, appVersion, appBuildNumber, platform, deviceModel, osVersion, screenName, reporterName, reporterEmail, extra, screenshot.

GET /updateCheck

The CodePush client's poll. Query: deploymentKey, appVersion, packageHash, label, clientUniqueId. Always answers 200; when there is nothing to give, isAvailable is false.

{
  "updateInfo": {
    "isAvailable": true,
    "isMandatory": false,
    "appVersion": "1.2.x",
    "packageHash": "c7de0582…",
    "label": "v4",
    "packageSize": 715,
    "downloadURL": "https://hashdrop.io/api/ota/download/…",
    "description": "Fix invoice totals"
  }
}

POST /reportStatus/deploy and /reportStatus/download

Status reports from the CodePush client. Always answer 200 — a device that cannot report must not retry forever or show a user an error.