Skip to content
~/apkbasket$ cat ./docs/README.md

Developer Docs & API

A terminal-style reference for distributing beta builds, sideloading verified APKs, and integrating APKBasket into your CI pipeline. Every endpoint, every schema field, every hash — documented exactly the way the index enforces it.

Read the API Docs Copy quickstart
  • 47-point scan
  • 14 min median verify
  • 99.97% uptime · 24mo
  • 1,840,000+ APKs
BASE_URL https://api.apkbasket.net/v3 200 OK · 47ms · TLS 1.3
[ 01 · Reference surfaces ]

Six doc surfaces. One consistent contract.

Pick the surface that matches your workflow — every block links to the same canonical schema, the same SHA-256 guarantees, and the same audit trail.

  1. 01 REST

    REST API Reference

    Versioned endpoints for package lookup, version pinning, signature verification, and bulk export. OpenAPI 3.1 spec published.

    • GET /v3/packages
    • GET /v3/packages/{pkg}/versions
    • POST /v3/verify
    Open reference
  2. 02 SCHEMA

    Metadata Schema

    The five verified fields every APK record exposes: SHA-256, manifest diff, signature block, VirusTotal cross-report, and pinned changelog.

    • sha256: string
    • manifest_diff: object
    • signature_block: object
    View schema
  3. 03 ADB

    ADB Sideload Guide

    Verified install paths for emulators, rooted devices, and CI runners — including known-good USB driver notes for Windows hosts.

    • adb install --verify
    • adb shell pm verify
    • USB driver matrix
    Sideload steps
  4. 04 SUBMIT

    Submission Guidelines

    How to upload a new APK to the index — pre-flight checks, signing requirements, beta-channel flags, and the 14-minute SLA from upload to listing.

    • Pre-flight checklist
    • v2/v3 signing reqs
    • Beta channel opt-in
    Read guidelines
[ 02 · Production endpoints ]

api.apkbasket.net — production endpoints

Every number below is read straight from the StatusGator audit and the in-house observability stack. Integration decisions can be made in one glance.

UPTIME · 24MO 99.97% StatusGator audited quarterly
P95 LATENCY 128ms Trailing 30d · global edge
DAILY REQUESTS 4.1M Average across 187 countries
INDEXED APKS 1.84M+ Across 312,000 packages
BLOCKLISTED · 30D 1,512 18,400+ blocked in 2024 to date
p50 · 47ms p99 · 312ms TLS 1.3 only Rate limit · 600 req/min per key All systems nominal
[ 03 · Metadata contract ]

Every APK record ships with five verified fields.

The transparency layer four direct competitors omit. Every value is reproducible from the underlying artifact — no opaque trust claims, no hidden provenance.

  1. 01
    string · required

    sha256

    The canonical SHA-256 digest of the APK file as served. Recompute on your end — if the digest doesn't match, the artifact was tampered with after listing.

    "sha256": "9f1c…b7e2"
  2. 02
    object · required

    manifest_diff

    A structured diff of AndroidManifest.xml between this version and the previous one in the same package. Surfaces added permissions, new activities, and exported components.

    "manifest_diff": { "added_permissions": ["INTERNET"], "new_activities": 3 }
  3. 03
    object · required

    signature_block

    The original developer signature, signer certificate chain, v2/v3 scheme presence, and a re-signing flag — set to true if the APK was modified and resigned after the original build.

    "signature_block": { "scheme": "v2+v3", "resigned": false }
  4. 04
    object · required

    vt_cross_report

    A cross-reference of the SHA-256 against VirusTotal's multi-engine corpus. We surface detections, total engines scanned, and the timestamp of the last cross-check — never just a "clean" badge.

    "vt_cross_report": { "engines": 72, "detections": 0, "checked_at": "2025-01-14T09:12Z" }
  5. 05
    string · required

    pinned_changelog

    The developer-supplied release notes, hash-pinned to the upload. Updates don't overwrite history — every version's notes stay attached to that version's record.

    "pinned_changelog": "Fix for camera2 callback race…"
[ 04 · Quickstart ]

Two ways to install a verified APK in under 60 seconds.

A curl-ready REST path for CI runners and integration tests. A parallel ADB sideload block for emulator enthusiasts and QA hands-on. Same hash, same artifact.

PATH A · REST ~10s

Pull a verified APK via the REST API.

Resolve the package, verify the SHA-256, then download from a signed CDN URL. Useful for CI runners, package managers, and integration tests.

# 1. Resolve latest verified version
curl -sS https://api.apkbasket.net/v3/packages/org.lineageos.recorder \
  | jq -r '.versions[0].sha256'

# 2. Verify the digest before download
curl -sS https://api.apkbasket.net/v3/packages/org.lineageos.recorder \
  | jq -r '.versions[0].cdn_url' \
  | xargs curl -sSL -o app.apk

sha256sum app.apk
PATH B · ADB ~45s

Sideload directly to a connected device.

For emulator testing and QA loops. The --verify flag tells ADB to re-check the signature chain against the device's installed trust store before install.

# Confirm device + USB driver
adb devices -l

# Sideload with explicit verification
adb install --verify \
  /path/to/app.apk

# Confirm package + signature on device
adb shell pm verify org.lineageos.recorder
PRO TIP

Both paths share the same SHA-256 contract. If the digest you compute locally doesn't match versions[0].sha256, the artifact was tampered with — abort the install and report the hash to [email protected].

[ END · Hand-off ]

Open the full API reference.

Every endpoint, every error code, every webhook payload — versioned, hash-pinned, and cross-linked to the StatusGator uptime report. Built for developers who want the long form, not the brochure.

Read the API Docs Submit an APK

No account required for read endpoints · Free API keys issued in < 2 minutes · 600 req/min default rate limit