Connections

A connection gives AppGoat access to your own store accounts. With it, agents can read your reviews with their reply status, your editable listing per locale and your Apple Ads campaigns (GET /v1/connections/{id}/reviews, /listings, /ads, 1 credit each) and propose actions: review replies, listing and keyword updates, screenshots, Apple Ads bids, keywords and negatives. Every action is a dry run with a before → after diff first; nothing is written until it is approved. You can connect accounts in the dashboard (dash.appgoat.ai → Connections) or with POST /v1/connections. Credentials are verified with one cheap read before anything is stored, encrypted with AES-256-GCM, and never returned.

curl -X POST "https://api.appgoat.ai/v1/connections" \
  -H "x-api-key: $APPGOAT_API_KEY" \
  -H "content-type: application/json" \
  -d '{
    "provider": "asc",
    "label": "My ASC key",
    "credentials": {
      "issuer_id": "57246542-96fe-1a63-e053-0824d011072a",
      "key_id": "2X9R4HXF34",
      "private_key": "-----BEGIN PRIVATE KEY-----\n…\n-----END PRIVATE KEY-----"
    },
    "apps": ["1234567890"]
  }'

Credentials per provider

App Store Connect (asc)
Google Play Console (play_console)
Apple Ads (apple_ads)

{ issuer_id, key_id, private_key, vendor_number? }

issuer_id: App Store Connect → Users and Access → Integrations → App Store Connect API, the Issuer ID above the keys table.
key_id: the Key ID of the API key (10 characters).
private_key: the contents of AuthKey_<KEY_ID>.p8, downloaded once when the key was created.
vendor_number (optional): from Payments and Financial Reports, for the downloads and proceeds sync.

Give the key the App Manager role (and Sales for the downloads and proceeds sync). apps defaults to every app the key can see.

{ service_account, reports_bucket? }

service_account: the Google Cloud service account JSON key file (Google Cloud console → IAM → Service accounts → Keys → Add key → JSON).
reports_bucket (optional): the pubsite_prod_… bucket, for install stats.

Invite the service account in Play Console → Users and permissions with View app information, Reply to reviews and Edit store listing (it can take up to 24 hours to apply). apps (package names) is required: the Play API cannot list them.

{ client_id, team_id, key_id, private_key, ad_account_id? }From Apple Ads → Account Settings → API, for an API user with the API Account Manager role: the Client ID (SEARCHADS.…) shown after uploading the public key, the Team ID and Key ID next to it, and the EC private key (PEM) whose public key you uploaded. ad_account_id is needed when the user can access several ad accounts; the error lists them.

If a provider rejects the credentials the answer is 422 invalid_credentials with error.param naming the field and error.hint saying where to find it.

Mode and plan limits

mode is actions (default) or read_only. On the Free plan connections are read-only; mode: "actions" returns 402 plan_limit.
Each linked app uses one of the plan’s connected apps (Free: 1).
Change the label, mode or linked apps with PATCH /v1/connections/{id}; re-check the credentials with POST /v1/connections/{id}/verify when a provider starts refusing access (provider_error).

Actions and approval

POST /v1/actions proposes a change and returns its diff and guardrail scores (policy, tone, claims). POST /v1/actions/{id}/approve applies it (1 credit when applied), or leaves it pending a person’s approval in the dashboard (403 forbidden with an approve_url). POST /v1/actions/{id}/reject discards it. The Reply to every review, Apple Ads optimizer and Localization push playbooks are built on this flow.

Getting started

Concepts

Guides

Errors

Credentials per provider

Mode and plan limits

Actions and approval

​Credentials per provider

​Mode and plan limits

​Actions and approval

Credentials per provider

Mode and plan limits

Actions and approval