> ## Documentation Index
> Fetch the complete documentation index at: https://docs.appgoat.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Connections

> Connect App Store Connect, Google Play Console or Apple Ads so agents can read your own reviews, listings and campaigns and propose changes.

A connection gives AppGoat access to your own store accounts. With it, agents can read your reviews with their reply status, your editable listing per locale and your Apple Ads campaigns ([`GET /v1/connections/{id}/reviews`](https://docs.appgoat.ai/api-reference/endpoint/list-connection-reviews), [`/listings`](https://docs.appgoat.ai/api-reference/endpoint/get-connection-listing), [`/ads`](https://docs.appgoat.ai/api-reference/endpoint/get-connection-ads), 1 credit each) and propose [actions](https://docs.appgoat.ai/api-reference/endpoint/create-action.md): review replies, listing and keyword updates, screenshots, Apple Ads bids, keywords and negatives. Every action is a dry run with a before → after diff first; nothing is written until it is approved.

You can connect accounts in the dashboard (dash.appgoat.ai → Connections) or with [`POST /v1/connections`](https://docs.appgoat.ai/api-reference/endpoint/create-connection). Credentials are verified with one cheap read before anything is stored, encrypted with AES-256-GCM, and never returned.

```bash theme={null}
curl -X POST "https://api.appgoat.ai/v1/connections" \
  -H "x-api-key: $APPGOAT_API_KEY" \
  -H "content-type: application/json" \
  -d '{
    "provider": "asc",
    "label": "My ASC key",
    "credentials": {
      "issuer_id": "57246542-96fe-1a63-e053-0824d011072a",
      "key_id": "2X9R4HXF34",
      "private_key": "-----BEGIN PRIVATE KEY-----\n…\n-----END PRIVATE KEY-----"
    },
    "apps": ["1234567890"]
  }'
```

## Credentials per provider

**App Store Connect (asc)**

`{ issuer_id, key_id, private_key, vendor_number? }`

* **issuer\_id**: App Store Connect → Users and Access → Integrations → App Store Connect API, the Issuer ID above the keys table.
* **key\_id**: the Key ID of the API key (10 characters).
* **private\_key**: the contents of `AuthKey_<KEY_ID>.p8`, downloaded once when the key was created.
* **vendor\_number** (optional): from Payments and Financial Reports, for the downloads and proceeds sync.

Give the key the App Manager role (and Sales for the downloads and proceeds sync). `apps` defaults to every app the key can see.

**Google Play Console (play\_console)**

`{ service_account, reports_bucket? }`

* **service\_account**: the Google Cloud service account JSON key file (Google Cloud console → IAM → Service accounts → Keys → Add key → JSON).
* **reports\_bucket** (optional): the `pubsite_prod_…` bucket, for install stats.

Invite the service account in Play Console → Users and permissions with View app information, Reply to reviews and Edit store listing (it can take up to 24 hours to apply). `apps` (package names) is required: the Play API cannot list them.

**Apple Ads (apple\_ads)**

`{ client_id, team_id, key_id, private_key, ad_account_id? }`

From Apple Ads → Account Settings → API, for an API user with the API Account Manager role: the Client ID (`SEARCHADS.…`) shown after uploading the public key, the Team ID and Key ID next to it, and the EC private key (PEM) whose public key you uploaded. `ad_account_id` is needed when the user can access several ad accounts; the error lists them.

If a provider rejects the credentials the answer is 422 [`invalid_credentials`](https://docs.appgoat.ai/errors/invalid_credentials) with `error.param` naming the field and `error.hint` saying where to find it.

## Mode and plan limits

* `mode` is `actions` (default) or `read_only`. On the Free plan connections are read-only; `mode: "actions"` returns 402 [`plan_limit`](https://docs.appgoat.ai/errors/plan_limit).
* Each linked app uses one of the plan's connected apps (Free: 1).
* Change the label, mode or linked apps with [`PATCH /v1/connections/{id}`](https://docs.appgoat.ai/api-reference/endpoint/update-connection); re-check the credentials with [`POST /v1/connections/{id}/verify`](https://docs.appgoat.ai/api-reference/endpoint/verify-connection) when a provider starts refusing access ([`provider_error`](https://docs.appgoat.ai/errors/provider_error)).

## Actions and approval

[`POST /v1/actions`](https://docs.appgoat.ai/api-reference/endpoint/create-action) proposes a change and returns its diff and guardrail scores (policy, tone, claims). [`POST /v1/actions/{id}/approve`](https://docs.appgoat.ai/api-reference/endpoint/approve-action) applies it (1 credit when applied), or leaves it pending a person's approval in the dashboard (403 [`forbidden`](https://docs.appgoat.ai/errors/forbidden) with an `approve_url`). [`POST /v1/actions/{id}/reject`](https://docs.appgoat.ai/api-reference/endpoint/reject-action) discards it. The [Reply to every review](https://appgoat.ai/playbooks/reply-to-every-review), [Apple Ads optimizer](https://appgoat.ai/playbooks/apple-ads-optimizer) and [Localization push](https://appgoat.ai/playbooks/localization-push) playbooks are built on this flow.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.