Found a workaround: direct access to buildBundles is blocked (403 "has no allowed operations defined"), but you can still get it via include. Working chain: GET /v1/builds/{buildId}?include=buildBundles — the bundle comes back in the included array GET /v1/buildBundles/{bundleId}/buildBundleFileSizes — per-device download/install sizes The include step is what bypasses the 403. Works with both Admin and App Manager keys.