Web app feature guide¶

The web app is the human-facing control plane for AppGantry. This page maps its screens to the jobs they perform, the access they require, and the more detailed guide for each workflow.

Use the API surface map when you need to automate the same work.

Area	What it contains
Dashboard	Your organizations, organization creation, and the My apps tester portal
Activity	Your developer-level audit activity, with date navigation and CSV export
Docs	This documentation site
Account menu → Settings	Profile, email, security, sessions, tokens, data export, and account deletion

The app hides organization navigation that your role cannot open. A hidden link is not the security boundary: the API checks authorization again on every request. See Authorization.

Dashboard and tester portal¶

The dashboard lists every organization you belong to and lets you create another, subject to the account limit.

My apps is the tester-facing side of the same account:

available releases are grouped by organization, project, and channel;
each release shows its version, platform, size, release date, and whether the update is mandatory;
iOS releases open the over-the-air install flow;
Android releases provide the install or download action; and
View my channels, at the top of the page, opens the separate My channels page, which explains why you have access and lets you mute or unmute release-notification email per channel.

See Managing testers & groups for the administrator's side of this workflow.

Organization screens¶

Open an organization from the dashboard. The left navigation is role-aware:

Screen	Minimum organization role to open	What you can do
Overview	Read	List projects and create a project when your permissions allow it
Usage	Admin	Review current-period cost, meter breakdown, estimates, and usage events
Billing	Admin	Review the plan and balance, add credit, and add or replace a payment method
Storage	Admin	On hosted storage: submit a BYOSA request, resubmit it after a validation failure or rejection, and withdraw one that has not yet been approved. Once BYOSA is active: inspect the configuration and run diagnostics against it
Testers	Admin	Add, resend, cancel, inspect, and remove organization-wide tester access
Groups	Admin	Create tester groups, manage members, and grant organization/project/channel access
Devices	Read	List enrolled Apple devices. Creating an enrollment link and removing a device need Editor or above
Audit log	Admin	Filter organization events and export them
Webhooks	Admin	Create subscriptions, choose events, inspect delivery history, test, pause, rotate, and delete
Settings	Read	View details and membership; administrative controls include editing, invitations, roles, ownership transfer, leaving, and deletion
Single sign-on	Admin	Configure SAML, claim and verify domains, test, enforce, and remove SSO

Some cards and buttons inside a readable screen require a higher role than the screen itself. For example, any member may open organization settings to inspect membership or leave, while role changes, ownership, and deletion remain administrative actions.

The Storage screen shows one of two things, depending on where the organization's builds live today: the onboarding request flow while it is on AppGantry-hosted storage, or the configuration and diagnostics once BYOSA is active. There is no control for changing an active BYOSA configuration in place, and none for moving back to hosted storage. Both are operator actions — contact support. See BYOSA setup.

Detailed workflows:

Project screens¶

Each project targets one platform. Its left navigation contains:

Screen	What you can do
Builds	Upload, filter, inspect, download, edit release notes, revoke, and delete builds
Channels	Create and edit channels, manage channel testers and invitations, publish a build into a channel as a release, view analytics, and create SDK apps
Testers	Add, resend, cancel, inspect, and remove project-level tester access
Store connections	Create, inspect, update, and delete provider credentials, and register Apple devices with Sync devices now. Credentials are checked against the provider when you save them, so there is no separate validate action
Publish	Create and inspect background store-publish jobs (App Store Connect, Google Play, Microsoft Intune). Pick a connection and a build here; there is no Publish action on a build
Access tokens	Create, rotate, revoke, and permanently delete project access tokens
Settings	Edit the name, description, and icon; manage project members and invitations; copy the project ID; delete the project

Two different things share the word publish

Publishing a build into a channel as a release is the working way to get a build to your testers. It lives under Channels → the channel → Releases → Publish a build, and it is described in Channels, releases, and analytics below.

The project-level Publish screen is the unrelated store publishing feature. It and its API create a job, but no provider has a working publisher behind it today, so every job fails without sending the artifact to App Store Connect, Google Play or Microsoft Intune. See Store connections & publishing.

Builds¶

The build list can be filtered by status, upload date, version, or build number. A build's detail page shows its identifiers and metadata and provides the actions allowed by your role.

Uploading uses the same two-phase flow as the API: initiate, upload the bytes directly to storage, then complete. See Getting started and API conventions.

Revoking and deleting are different:

Revoke prevents future downloads while preserving the record.
Delete removes the artifact and is permanent.

See Build lifecycle & retention.

Channels, releases, and analytics¶

A channel screen manages its settings, direct testers, pending invitations, releases, public-install state, and SDK apps.

To get a build to testers, open Channels, open the channel, go to its Releases, and use Publish a build: pick an existing build, optionally override the release notes for this channel, choose whether the release is mandatory, and confirm. This is the only place in the web app that creates a release, and it is unrelated to the project-level Publish screen, which targets App Store Connect, Google Play and Microsoft Intune and is not operational.

A release detail screen can:

open release analytics and per-tester install status;
roll back, disable, or re-enable the release;
mark it mandatory or optional; and
delete it from the channel.

See Channels & releases.

Account settings¶

Card or page	What you can do
Account	Read your Developer ID — the identifier support and the API address you by — and your organization limit, the number of organizations this account may create
Profile picture	Upload or remove a PNG, JPEG, or WebP avatar up to 1 MiB
Profile	Change your display name
Email address	Start a verified email-address change
Security	Reset your password, enroll or disable TOTP, manage recovery codes, and register, rename, or remove passkeys
Active sessions	Review signed-in devices, revoke one session, or log out everywhere
Personal access tokens	Create, rotate, revoke, and permanently delete your organization-bound PATs
Your data	Request and download a personal data export
Danger zone	Schedule account deletion or cancel it from the emailed recovery link during the grace period

See MFA, passkeys & sessions and Account & data management.

Web app and API differences¶

Most product workflows exist on both surfaces, but not all:

Capability	Web app	API
Organization MFA policy	No dedicated screen	`GET`/`PUT /api/v1/organizations/{organization_id}/mfa-policy`
Monthly spend cap	No dedicated screen	`GET`/`PUT /api/v1/organizations/{organization_id}/spend-cap`
Changing the plan tier (Team ↔ Business)	No plan switcher anywhere	`POST /api/v1/organizations/{organization_id}/tier` — organization Admin and an `ALL`-scoped credential. An admin's `ALL`-scoped PAT is accepted; an interactive session is not required
Minting an `ALL`-scoped personal access token	Not offered — the create form renders one checkbox per named scope	`POST /api/v1/pats`, from an interactive sign-in
Organization-wide PAT inventory and revocation	No admin screen	API only — routes and their required parameters are in Feature availability
Effective organization feature flags	No screen — the app's own gating comes from your role, your plan, and how the deployment is configured	`GET /api/v1/organizations/{organization_id}/feature-flags`, a diagnostic read of what the deployment and your account enable rather than the switch behind every control. See Feature Flags
Public and SDK install flows	Browser landing/install pages	`/public/v1` and `/sdk/v1` operations

Feature availability is the canonical list of the API-only controls, including the exact routes, the query parameters each one requires, and the role needed to call it. It also tracks any environment or plan gates.

If a control is missing¶

Check these in order:

Your organization or project role.
Whether the organization is write-locked by billing.
Whether the feature is plan- or environment-gated.
Whether it is one of the API-only controls above.

The API remains authoritative for authorization and returns a machine-readable error when an action is refused. See Errors.