API

Create, upload, and publish.

The public publishing API is a three-request control flow with a direct presigned PUT between artifact declaration and final publication.

Base: releases.mateality.comJSON + direct PUT

All publishing requests use:

text
https://releases.mateality.com

and require a publish key.

1. Create a draft

http
POST /v1/apps/{app-slug}/releases
Content-Type: application/json
Authorization: Bearer {publish-key}
json
{
  "channel": "stable",
  "version": "1.4.2",
  "notes": "Release notes",
  "pubDate": "2026-07-28T10:00:00.000Z"
}
versionstringRequired

1–128 allowed characters; begins with a letter or number.

channelstring

An existing active channel.

Default: stable
notesstring

Release notes, at most 64 KiB.

pubDatedate-time

A value accepted by JavaScript Date parsing.

Default: request time

Success is 201 with { "release": ... }. Save release.id.

2. Declare an artifact

http
POST /v1/apps/{app-slug}/artifacts/presign
Content-Type: application/json
Authorization: Bearer {publish-key}
json
{
  "channel": "stable",
  "version": "1.4.2",
  "target": "linux-x86_64",
  "format": ".zip",
  "size": 8459217,
  "sha256": "64-lowercase-hex-characters",
  "signature": null,
  "contentType": "application/zip"
}
channelstring

Must match the draft’s channel.

Default: stable
versionstringRequired

Must match an existing draft version.

targetstringRequired

1–128 letters, numbers, dot, underscore, or hyphen.

formatstringRequired

Leading dot plus up to 64 allowed characters.

sizeintegerRequired

Positive byte count within the deployment artifact limit.

sha256stringRequired

Exactly 64 hexadecimal characters; normalized to lowercase.

signaturestring | null

Adapter-specific signature text, at most 32 KiB.

contentTypestring

Printable MIME type containing `/`, at most 200 characters.

The response contains artifact, uploadUrl, and headers.

3. Upload bytes

http
PUT {uploadUrl}
{every header returned by the presign response}

{exact artifact bytes}

Do not attach the publish key to the storage URL. Send the exact declared byte length and every returned header, including server-side encryption.

4. Publish

http
POST /v1/apps/{app-slug}/releases/{release-id}/publish
Authorization: Bearer {publish-key}

Success is 200 with { "release": ... }. The release’s publication time is set to the server’s current time.