grant_app_permission
Grant a principal (teammate or service account) access to ONE app, as an APPEND that preserves every existing app grant and all account-level permissions. Use it to give a CI service account release access to a newly-created app — the step the androidpublisher API cannot do for a release-scoped service account (it 403s, it cannot grant itself access); this runs on the owner's Play Console session. DRY-RUN BY DEFAULT: with commit omitted/not "true" it pre-reads and returns the exact before/after WITHOUT writing — show that to the user and get their explicit agreement to this specific account-permissions change, then re-run with commit="true". A relayed approval is not the user's approval. The write is append-only (refuses to drop or shrink any existing grant), scoped so account-level permissions are untouched, and re-reads afterwards to prove the append. For the permission set, prefer copy_permissions_from_app_id (copies an existing grant's values verbatim — matches the account's pattern and names no enum value).
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| commit | No | Must be exactly "true" (or "yes") to actually write. Omit/anything else = dry-run that returns the before/after without writing. Only set it once the USER has agreed to this specific account-permissions change after seeing the dry-run. | |
| developer_id | Yes | Numeric Play Console developer id (from the Play Console URL). | |
| target_app_id | Yes | NUMERIC app id (from the Play Console URL) of the app to grant access to — NOT the package name. | |
| write_variant | No | Request shape for the grant write: "auto" (default) tries the known-good shapes in order. Pin a specific variant only when debugging a refused grant. | |
| permission_values | No | Alternative to copy_permissions_from_app_id: a JSON array of integer permission values for a least-privilege set, e.g. "[1,6]" (CAN_ACCESS_APP, CAN_MANAGE_TRACK_APKS — upload + testing-track release). | |
| target_user_email | Yes | The principal being granted access — e.g. the CI service account …@….iam.gserviceaccount.com. Must already exist on the account. | |
| google_account_email | Yes | The signed-in owner account email that is acting. Call list_accounts first and confirm with the user — do not guess. | |
| notification_message | No | Short user-facing sentence for this action if the follow-up reply fails. Plain text only; do not mention template syntax or variable names. | |
| copy_permissions_from_app_id | No | Preferred: numeric app id of an app the principal ALREADY has, whose permission values are copied verbatim onto the new grant. Matches the existing pattern and avoids naming any enum value. |