Mobile Deep Link Preflight

Mobile Deep Link Preflight checks public iOS and Android association files before or after a mobile release.

What it checks

• AASA file reachability at .well-known and root paths
• assetlinks.json reachability at .well-known
• Redirect observations
• Content-Type signals
• AASA JSON parseability and size
• Observed iOS app IDs
• Observed Android package names and SHA-256 certificate fingerprints
• Optional expected-value matching against supplied app identifiers

How it works

Submit bare domains and, if available, expected app identifiers. The Actor fetches public association files, records normalized parser signals, writes report files, and returns one dataset row per finding. If expected values are omitted, the Actor reports presence and syntax signals only and marks identifier matching as skipped.

For recurring drift records after this one-off preflight, submit the public AASA and assetlinks URLs to Policy Page Drift Pack. That pack records reachability and content-fingerprint drift but does not replace the syntax and expected-value checks here.

Outputs

• Dataset rows: one row per finding
• REPORT.json: full structured report and evidence pack
• REPORT.html: readable report
• REPORT.md: Markdown report

Billing

Pay-per-event billing is based only on domains where at least one public association file was reachable. Invalid input and domains with no reachable association file are not charged as checked domains.

Boundary

This Actor does not inspect app binaries, entitlements, Android manifests, OS caches, app-store settings, user devices, or runtime link behavior. It records public association-file signals observed at run time.

Related tools

• Checksmith CI - Use earlier in CI when AASA and assetlinks files are still local.
• Security Headers Bulk QA - Use when deployed association files should be checked alongside response headers.
• Policy Page Drift Pack - Use when well-known and policy files need recurring drift records.

Minimal input

{
  "domains": [
    "links.example"
  ],
  "iosTeamId": "ABCDE12345",
  "iosBundleIds": [
    "com.example.app"
  ],
  "androidPackageNames": [
    "com.example.app"
  ],
  "sha256CertFingerprints": [
    "14:6D:E9:83:C5:73:06:50:D8:EE:B9:95:2F:34:FC:64:16:A0:83:42:E6:1D:BE:A8:8A:04:96:B2:3F:CF:44:E5"
  ]
}

API and scheduled use

Run the same validated input from Apify Console, the Actor API, CLI, schedules, or integrations. The run writes machine-readable findings to the default dataset and the complete report to the run storage.

Common input errors

Start with the published example and keep domains, iosTeamId, iosBundleIds, androidPackageNames, sha256CertFingerprints in the documented JSON shape. Malformed JSON, unsupported URL schemes, missing required values, and inputs above the stated limits are rejected rather than repaired silently.