@@ -204,7 +204,7 @@ An entry under `rp` may also list the Android and iOS apps that share its RP ID,
 | `androidApps[].packageName` | Android application package name |
 | `androidApps[].sha256CertFingerprints` | SHA-256 fingerprints of the app signing certificate, colon-separated hex |
 | `androidApps[].distribution` | `play-store` or `self-signed`: which signing certificate the fingerprints belong to |
-| `iosApps[].teamId` | Apple Developer Team ID |
+| `iosApps[].teamId` | Apple Developer Team ID, or the app's App ID prefix when that differs (older apps) |
 | `iosApps[].bundleId` | Application bundle identifier |
 
 This is the single place an RP's native apps are recorded. It is what the `assetlinks.json` and
@@ -220,6 +220,37 @@ these fields existed, and nothing needs changing on upgrade.
 To check that the `assetlinks.json` and `apple-app-site-association` files an RP has deployed match these
 entries, see [Native App Readiness](native-app-readiness.md).
 
+#### Exporting the association files
+
+The server generates both files from these fields, for you to deploy on the RP-ID host. They are the same
+files the readiness check compares a deployed copy against.
+
+| Request | File |
+| --- | --- |
+| `GET /jans-fido2/restv1/rp/{rpConfigId}/association/assetlinks.json` | Android `assetlinks.json`, one statement per `androidApps` entry |
+| `GET /jans-fido2/restv1/rp/{rpConfigId}/association/apple-app-site-association` | Apple file, one `TeamID.BundleID` per complete `iosApps` entry |
+
+`{rpConfigId}` is the RP `id` as configured, URL-encoded. The answer is a JSON download, `404` when the RP is
+not configured or has no app of that platform. Nothing is served from Jans: both Apple and Android fetch
+`https://<rp-id>/.well-known/...` without following redirects, so deploy each file on the RP-ID host itself.
+Apple's file is named `apple-app-site-association`, with no `.json` extension.
+
+**Merge the exported entries into any file that is already there; do not replace it.** The exports describe
+only the passkey (`webcredentials` and `get_login_creds`) entries. A host that already serves these files may
+also use them for universal links or Android App Links, such as `applinks` in the Apple file or other
+statements in `assetlinks.json`, and overwriting the file removes those. Add the exported statements to the
+Android array, and the exported app IDs to `webcredentials.apps`, and leave everything else as it is.
+
+**Check that `teamId` is the app's App ID prefix.** Apple expects `<App ID prefix>.<bundle ID>` in
+`webcredentials.apps`. For most apps the prefix is the Team ID, but for older apps it can be a different value.
+Use the prefix shown for the app's App ID under Identifiers in your Apple Developer account (it is also the
+part before the bundle ID in the app's `application-identifier` entitlement), and record that value as `teamId`.
+
+After deploying, run the native app readiness check for the same RP
+(`POST /jans-fido2/restv1/rp/{rpConfigId}/readiness`, which needs `nativeReadinessEnabled` and
+`nativeReadinessAllowExternalFetch`) to confirm the deployed files match the configured apps. A mismatched
+fingerprint or Team ID is the most common deployment failure, and the check reports it.
+
 ### Native app readiness
 
 The `nativeReadiness*` properties control a check that compares the `assetlinks.json` and
 
@@ -18,6 +18,7 @@
 import io.jans.fido2.ws.rs.controller.ConfigurationController;
 import io.jans.fido2.ws.rs.controller.Fido2MetricsController;
 import io.jans.fido2.ws.rs.controller.Fido2TrustController;
+import io.jans.fido2.ws.rs.controller.AssociationFileController;
 import io.jans.fido2.ws.rs.controller.NativeReadinessController;
 
 /**
@@ -39,6 +40,7 @@ public Set<Class<?>> getClasses() {
         classes.add(Fido2MetricsController.class);
         classes.add(Fido2TrustController.class);
         classes.add(NativeReadinessController.class);
+        classes.add(AssociationFileController.class);
 
         return classes;
     }
 
@@ -0,0 +1,61 @@
+/*
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
+ *
+ * Copyright (c) 2026, Janssen Project
+ */
+
+package io.jans.fido2.service.readiness;
+
+import com.fasterxml.jackson.databind.JsonNode;
+
+import io.jans.fido2.model.conf.AppConfiguration;
+import io.jans.fido2.model.conf.Fido2Configuration;
+import io.jans.fido2.model.conf.RequestedParty;
+import io.jans.fido2.service.readiness.NativeReadinessService.NotFound;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
+
+/**
+ * Produces the {@code assetlinks.json} and {@code apple-app-site-association} files of a configured relying
+ * party, for the admin to deploy on the RP-ID host. Both come from {@link ExpectedAssociationFileBuilder},
+ * the same definition the readiness checker compares the deployed files against. Nothing is fetched or served
+ * from here.
+ */
+@ApplicationScoped
+public class AssociationFileExporter {
+
+    @Inject
+    private AppConfiguration appConfiguration;
+
+    /**
+     * @throws NotFound when no relying party has that id, or it has no Android app to describe
+     */
+    public JsonNode assetLinks(String rpConfigId) {
+        RequestedParty party = party(rpConfigId);
+        if (ExpectedAssociationFileBuilder.androidApps(party).isEmpty()) {
+            throw new NotFound();
+        }
+        return ExpectedAssociationFileBuilder.assetLinks(party);
+    }
+
+    /**
+     * @throws NotFound when no relying party has that id, or it has no complete iOS app to describe
+     */
+    public JsonNode appleAppSiteAssociation(String rpConfigId) {
+        RequestedParty party = party(rpConfigId);
+        JsonNode file = ExpectedAssociationFileBuilder.appleAppSiteAssociation(party);
+        if (file.path("webcredentials").path("apps").isEmpty()) {
+            throw new NotFound();
+        }
+        return file;
+    }
+
+    private RequestedParty party(String rpConfigId) {
+        Fido2Configuration config = appConfiguration.getFido2Configuration();
+        RequestedParty party = config == null ? null : NativeReadinessService.find(config, rpConfigId);
+        if (party == null) {
+            throw new NotFound();
+        }
+        return party;
+    }
+}
@@ -247,7 +247,7 @@ private static int fileCount(RequestedParty party) {
                 + (ExpectedAssociationFileBuilder.iosApps(party).isEmpty() ? 0 : 1);
     }
 
-    private static RequestedParty find(Fido2Configuration config, String id) {
+    static RequestedParty find(Fido2Configuration config, String id) {
         if (id == null || config.getRequestedParties() == null) {
             return null;
         }
 
@@ -0,0 +1,77 @@
+/*
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
+ *
+ * Copyright (c) 2026, Janssen Project
+ */
+
+package io.jans.fido2.ws.rs.controller;
+
+import com.fasterxml.jackson.core.JsonProcessingException;
+import com.fasterxml.jackson.databind.JsonNode;
+
+import io.jans.fido2.service.DataMapperService;
+import io.jans.fido2.service.readiness.AssociationFileExporter;
+import io.jans.fido2.service.readiness.NativeReadinessService.NotFound;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
+import jakarta.ws.rs.GET;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.PathParam;
+import jakarta.ws.rs.Produces;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
+
+/**
+ * Exports the native app association files of one configured relying party, to be deployed by the admin on
+ * the RP-ID host's {@code /.well-known/} path: {@code GET /rp/{rpConfigId}/association/assetlinks.json} and
+ * {@code GET /rp/{rpConfigId}/association/apple-app-site-association}.
+ * <p>
+ * {@code rpConfigId} is the RP id exactly as configured, as a URL-encoded path segment. The answer is 404 for
+ * an id that is not configured, and also when the RP has no app of that platform, since there is nothing to
+ * deploy. The body is the file itself, sent as a download; the Apple file's name has no extension, as Apple
+ * requires. These endpoints only read configuration and make no outbound request.
+ * <p>
+ * SECURITY NOTE: as with {@link NativeReadinessController}, authentication and authorization are expected to
+ * be enforced at the infrastructure level or via the Config API fido2 plugin, not here.
+ *
+ * @author Janssen Project
+ */
+@ApplicationScoped
+@Path("/rp/{rpConfigId}/association")
+public class AssociationFileController {
+
+    @Inject
+    private AssociationFileExporter exporter;
+
+    @Inject
+    private DataMapperService dataMapperService;
+
+    @GET
+    @Path("/assetlinks.json")
+    @Produces(MediaType.APPLICATION_JSON)
+    public Response assetLinks(@PathParam("rpConfigId") String rpConfigId)
+            throws JsonProcessingException {
+        try {
+            return download(exporter.assetLinks(rpConfigId), "assetlinks.json");
+        } catch (NotFound e) {
+            return Response.status(Response.Status.NOT_FOUND).build();
+        }
+    }
+
+    @GET
+    @Path("/apple-app-site-association")
+    @Produces(MediaType.APPLICATION_JSON)
+    public Response appleAppSiteAssociation(@PathParam("rpConfigId") String rpConfigId)
+            throws JsonProcessingException {
+        try {
+            return download(exporter.appleAppSiteAssociation(rpConfigId), "apple-app-site-association");
+        } catch (NotFound e) {
+            return Response.status(Response.Status.NOT_FOUND).build();
+        }
+    }
+
+    private Response download(JsonNode file, String fileName) throws JsonProcessingException {
+        return Response.ok(dataMapperService.writeValueAsString(file))
+                .header("Content-Disposition", "attachment; filename=\"" + fileName + "\"").build();
+    }
+}
@@ -0,0 +1,103 @@
+/*
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
+ *
+ * Copyright (c) 2026, Janssen Project
+ */
+
+package io.jans.fido2.service.readiness;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.mockito.Mockito.when;
+
+import java.util.List;
+
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.mockito.InjectMocks;
+import org.mockito.Mock;
+import org.mockito.junit.jupiter.MockitoExtension;
+
+import com.fasterxml.jackson.databind.JsonNode;
+
+import io.jans.fido2.model.conf.AndroidApp;
+import io.jans.fido2.model.conf.AppConfiguration;
+import io.jans.fido2.model.conf.Fido2Configuration;
+import io.jans.fido2.model.conf.IosApp;
+import io.jans.fido2.model.conf.RequestedParty;
+import io.jans.fido2.service.readiness.NativeReadinessService.NotFound;
+
+@ExtendWith(MockitoExtension.class)
+class AssociationFileExporterTest {
+
+    private static final String FP = "AA:BB:CC:DD:EE:FF:00:11:22:33:44:55:66:77:88:99:AA:BB:CC:DD:EE:FF:00:11:22:33:44:55:66:77:88:99";
+
+    @Mock
+    private AppConfiguration appConfiguration;
+
+    @InjectMocks
+    private AssociationFileExporter exporter;
+
+    private RequestedParty party;
+
+    @BeforeEach
+    void setUp() {
+        party = new RequestedParty();
+        party.setId("example.com");
+        Fido2Configuration config = new Fido2Configuration();
+        config.setRequestedParties(List.of(party));
+        when(appConfiguration.getFido2Configuration()).thenReturn(config);
+    }
+
+    private static AndroidApp android(String pkg, String... fingerprints) {
+        AndroidApp app = new AndroidApp();
+        app.setPackageName(pkg);
+        app.setSha256CertFingerprints(List.of(fingerprints));
+        return app;
+    }
+
+    private static IosApp ios(String team, String bundle) {
+        IosApp app = new IosApp();
+        app.setTeamId(team);
+        app.setBundleId(bundle);
+        return app;
+    }
+
+    @Test
+    void assetLinks_isTheBuilderOutput_forTheConfiguredAndroidApps() {
+        party.setAndroidApps(List.of(android("com.example.app", FP.toLowerCase())));
+
+        JsonNode file = exporter.assetLinks("example.com");
+
+        assertEquals(ExpectedAssociationFileBuilder.assetLinks(party), file);
+        assertEquals("com.example.app", file.get(0).path("target").path("package_name").asText());
+        assertEquals(FP, file.get(0).path("target").path("sha256_cert_fingerprints").get(0).asText());
+    }
+
+    @Test
+    void appleAppSiteAssociation_listsTeamIdDotBundleId() {
+        party.setIosApps(List.of(ios("TEAM123456", "com.example.app")));
+
+        JsonNode file = exporter.appleAppSiteAssociation("example.com");
+
+        assertEquals("TEAM123456.com.example.app", file.path("webcredentials").path("apps").get(0).asText());
+    }
+
+    @Test
+    void unknownRp_isNotFound() {
+        assertThrows(NotFound.class, () -> exporter.assetLinks("other.example"));
+        assertThrows(NotFound.class, () -> exporter.appleAppSiteAssociation(null));
+    }
+
+    @Test
+    void rpWithoutAppsOfThePlatform_hasNothingToExport() {
+        party.setAndroidApps(List.of(android("com.example.app", FP)));
+        party.setIosApps(List.of(ios("TEAM123456", " ")));
+
+        assertThrows(NotFound.class, () -> exporter.appleAppSiteAssociation("example.com"));
+
+        party.setAndroidApps(null);
+        assertThrows(NotFound.class, () -> exporter.assetLinks("example.com"));
+    }
+}
Original file line number	Diff line number	Diff line change
`@@ -247,7 +247,7 @@ private static int fileCount(RequestedParty party) {`
`247`	`247`	`+ (ExpectedAssociationFileBuilder.iosApps(party).isEmpty() ? 0 : 1);`
`248`	`248`	`}`
`249`	`249`
`250`		`- private static RequestedParty find(Fido2Configuration config, String id) {`
	`250`	`+ static RequestedParty find(Fido2Configuration config, String id) {`
`251`	`251`	`if (id == null \|\| config.getRequestedParties() == null) {`
`252`	`252`	`return null;`
`253`	`253`	`}`