> ## Documentation Index
> Fetch the complete documentation index at: https://how.to.usegolem.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Mobile API

> Mobile store search, binary upload, and prescan endpoints

# Mobile API

Endpoints for working with mobile apps (iOS / Android). See [Mobile Audits](/audits/mobile) for the product-level flow.

## Search the app stores

`GET /api/mobile/search?q=com.acme&platform=android`

```bash theme={null}
curl -H "Authorization: Bearer $GOLEM_API_KEY" \
  "https://api.usegolem.ai/api/mobile/search?q=com.acme.app&platform=android"
```

Returns store metadata (name, developer, icon, version) for matching identifiers — used when adding a mobile app. Rate-limited to 30 requests per minute per client.

## Upload an iOS binary

iOS audits require the actual `.ipa`. Request a presigned upload URL, then upload:

| Endpoint                                       | Purpose                       |
| ---------------------------------------------- | ----------------------------- |
| `POST /api/apps/{id}/mobile-binary/upload-url` | Get a presigned S3 upload URL |
| `POST /api/apps/{id}/mobile-binary/confirm`    | Confirm the upload completed  |

After confirmation, the binary is available to the mobile audit pipeline.

## Run a prescan

`POST /api/apps/{id}/prescan`

```bash theme={null}
curl -X POST https://api.usegolem.ai/api/apps/{id}/prescan \
  -H "Authorization: Bearer $GOLEM_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"platform": "ios"}'
```

Returns a `runId` to poll via `GET /api/mobile-prescan/{runId}`. The prescan pulls the binary (from your uploaded `.ipa` for iOS, or the store for Android) and produces a static inventory — embedded endpoints, secrets, and configuration issues.

Only available on mobile apps, and only for platforms with a recorded identifier. iOS additionally requires an uploaded binary.

## Check prescan results

`GET /api/mobile-prescan/{runId}`

Returns the prescan status and its structured findings inventory.

## Provisioning internals

`POST /api/apps/mobile-provision` and the `/api/internal/mobile/download-*` endpoints are used by the dashboard and sandbox infrastructure — you won't call these directly.

## Error reference

| Error                                                               | Meaning                                      |
| ------------------------------------------------------------------- | -------------------------------------------- |
| `Prescan is only available for mobile apps`                         | Wrong app type                               |
| `Mobile app is missing platform or identifier`                      | App has no store identifier recorded         |
| `This app has no record for the requested platform`                 | Requested platform not configured on the app |
| `Upload your .ipa file on the assets page before running a prescan` | iOS binary missing                           |