NomidManage library apps
Read apps and releases, edit metadata and tracks, and hide or restore published content.
Access and scope
Every route requires X-API-Key with LIBRARY_MANAGE. The validated key selects the company; requests have no tenant or company parameter. An existing key with LIBRARY_MANAGE can use these routes without another grant. The sensitive grant is unchecked by default; keys without it do not gain it automatically.
LIBRARY_MANAGE is a sensitive, company-wide grant for APK uploads and app management. It does not grant policy assignment, device commands, provisioning or account operations.
LIBRARY_MANAGE covers APK uploads and the app management routes below. Public APIs for files, contacts and other library resources are not yet available. This grant does not provide policy assignment, device commands, provisioning or account administration.
Display-name and icon edits use deferred metadata rollouts. App hiding uses the existing removal sweep; restoring content and adding tracks use existing synchronization paths. Category edits update stored labels. Removing a track or hiding one of several published releases does not schedule immediate device synchronization. An API response confirms the store write, not device synchronization or installation.
Endpoints
https://api.nomid.tech/emm/api/v1
| Method | Endpoint | Description |
|---|---|---|
| GET | /library/apps | List visible apps in pages; includeHidden can include hidden apps. |
| GET | /library/apps/{packageName} | Get one app, including when hidden. |
| GET | /library/apps/{packageName}/versions | List versions; includeHidden can include hidden releases. |
| GET | /library/apps/{packageName}/versions/{versionCode} | Get one version, including when hidden. Supply its environment when nonempty. |
| PATCH | /library/apps/{packageName}/display-name | Set a display name or reset it to the APK name. |
| PATCH | /library/apps/{packageName}/categories | Replace the app category labels. |
| POST | /library/apps/{packageName}/icon | Upload an icon as multipart form-data using the file field. |
| DELETE | /library/apps/{packageName}/icon | Remove the custom icon. |
| DELETE | /library/apps/{packageName} | Hide an existing app; returns 204 and does not physically delete it. |
| POST | /library/apps/{packageName}/publish | Restore an app idempotently; returns the app. |
| DELETE | /library/apps/{packageName}/versions/{versionCode} | Hide an existing release; returns 204. For the last published release, the app becomes hidden while that release stays published for restoration. Supply its environment when nonempty. |
| POST | /library/apps/{packageName}/versions/{versionCode}/publish | Restore a release and, when needed, its app. Supply its environment when nonempty. |
| GET | /library/apps/{packageName}/tracks | List the latest published release for each track on a published app. For equal version codes, the lexicographically highest environment wins. |
| PUT | /library/apps/{packageName}/versions/{versionCode}/tracks/{trackName} | Assign a published release to a track; returns the assignment. Supply its environment when nonempty. |
| DELETE | /library/apps/{packageName}/versions/{versionCode}/tracks/{trackName} | Remove a track assignment; returns 204. Supply its environment when nonempty. |
Requests and responses
GET /library/apps accepts page (default 0), size (default 50, maximum 100) and includeHidden (default false). The response has content (AppDto[]), page, size, totalElements and totalPages.
The versions collection defaults to includeHidden=false and returns releases with versionCode, environment, status, displayName, displayVersion, createdAt, sha256, fileSizeBytes and tracks. Every version-targeted read, hide, publish or track change selects the exact packageName, versionCode and environment. Omitting environment selects the empty environment. Always supply it for a release with a nonempty environment, even when its version code is unique.
The display-name endpoint accepts a displayName string; null or an empty value resets the name, otherwise the limit is 100 characters. The categories endpoint requires a categories array with at most 50 nonblank labels of at most 100 characters each. Icon upload uses multipart field file.
Track names are trimmed and must be 1 to 10 characters. PUT and DELETE track assignments require a published app and published release. Always supply the release’s environment when it is nonempty.
Custom icons must be PNG or JPEG, at most 1 MiB, at least 192 pixels on each side, and square within 2%. The server normalizes accepted images to a 512-pixel PNG.
PATCH /library/apps/com.example.app/display-name
Content-Type: application/json
{"displayName":"Field App"}
PATCH /library/apps/com.example.app/categories
Content-Type: application/json
{"categories":["Field tools"]}Visibility and release behavior
Deleting an app hides it while retaining its data. Publishing the app restores it and is safe to repeat. The single-app endpoint can inspect a hidden app; the apps collection lists visible apps unless includeHidden=true.
Deleting an existing release hides it, except when it is the last published release: then the app becomes hidden and that release remains published so the app can be restored. A hidden release can be published again; publishing a release can also restore its app.
The tracks collection returns the latest published release per track for a published app. When version codes tie, the lexicographically highest environment wins. Track changes do not create policy assignments.
Errors
401 means the key is missing, invalid, expired or revoked. 403 means it lacks LIBRARY_MANAGE. Check key configuration without printing the key.
404 means the requested app or release is missing from the key company, or an operation requires a published app or release. Display-name, category and custom-icon edits require a published app; restore a hidden app before editing metadata. Track operations require a published app and release. A foreign-company identifier is not disclosed.
400 means a request or query value is invalid. Correct it before retrying.