# asc_patch_promoted_purchases_order

PATCH /v1/apps/{id}/relationships/promotedPurchases with the ordered list of promoted-purchase IDs. The order in the array IS the storefront display order — slot 1 is the first ID, slot 2 the second, etc. Send the FULL ordered list; Apple replaces the entire ordering. Use asc_list_promoted_purchases to enumerate current IDs first.

Agent View of the PolicyLayer registry record for `asc_patch_promoted_purchases_order`. HTML page: https://policylayer.com/tools/io-github-akoskomuves-appstoreconnect-mcp/asc-patch-promoted-purchases-order

## Facts

- Tool: `asc_patch_promoted_purchases_order`
- Server: Appstoreconnect Mcp (`@akoskomuves/appstoreconnect-mcp`) — https://policylayer.com/tools/io-github-akoskomuves-appstoreconnect-mcp.md
- Install: `npx -y @akoskomuves/appstoreconnect-mcp`
- Homepage: https://github.com/akoskomuves/appstoreconnect-mcp
- Risk category: Write (Medium risk)
- Registry record: grade F, identity unverified
- Server rate-limited: no
- Parameters: 0
- Recommended policy verdict: Rate-limited

## Example call (MCP tools/call, JSON-RPC 2.0)

```json
{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "asc_patch_promoted_purchases_order",
    "arguments": {}
  }
}
```

## Why asc_patch_promoted_purchases_order is rated Medium

This tool modifies app store configuration (promoted purchase display order) but does not delete data or cause financial transactions. It's a Write operation because it changes configuration reversibly. Severity is medium because misuse could affect app monetization visibility and customer experience, but the changes are reversible and don't involve destructive operations, code execution, or financial movements.

From the tool's own definition: "PATCH operation that modifies the ordering of promoted purchases on App Store storefronts. The description states 'Apple replaces the entire ordering,' indicating a reversible modification to storefront display configuration."

Risk signals: Bulk/mass operation — affects multiple targets

## Use case

AI agents use asc_patch_promoted_purchases_order to create or update resources in Appstoreconnect Mcp, usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your Appstoreconnect Mcp environment.

## Recommended policy (PolicyLayer)

Verdict: **Rate-limited**. Enforced by the PolicyLayer MCP gateway (https://policylayer.com/mcp-gateway) before a call reaches Appstoreconnect Mcp:

```json
{
  "version": "1",
  "default": "deny",
  "tools": {
    "asc_patch_promoted_purchases_order": {
      "limits": [
        {
          "counter": "asc_patch_promoted_purchases_order_rate",
          "window": "minute",
          "max": 30,
          "scope": "grant"
        }
      ]
    }
  }
}
```

## Other tools on Appstoreconnect Mcp (277)

- `asc_delete_accessibility_declaration` — Destructive — https://policylayer.com/tools/io-github-akoskomuves-appstoreconnect-mcp/asc-delete-accessibility-declaration.md
- `asc_delete_alternative_distribution_domain` — Destructive — https://policylayer.com/tools/io-github-akoskomuves-appstoreconnect-mcp/asc-delete-alternative-distribution-domain.md
- `asc_delete_alternative_distribution_key` — Destructive — https://policylayer.com/tools/io-github-akoskomuves-appstoreconnect-mcp/asc-delete-alternative-distribution-key.md
- `asc_delete_analytics_report_request` — Destructive — https://policylayer.com/tools/io-github-akoskomuves-appstoreconnect-mcp/asc-delete-analytics-report-request.md
- `asc_delete_app_custom_product_page` — Destructive — https://policylayer.com/tools/io-github-akoskomuves-appstoreconnect-mcp/asc-delete-app-custom-product-page.md
- `asc_delete_app_custom_product_page_localization` — Destructive — https://policylayer.com/tools/io-github-akoskomuves-appstoreconnect-mcp/asc-delete-app-custom-product-page-localization.md
- `asc_delete_app_custom_product_page_version` — Destructive — https://policylayer.com/tools/io-github-akoskomuves-appstoreconnect-mcp/asc-delete-app-custom-product-page-version.md
- `asc_delete_app_event` — Destructive — https://policylayer.com/tools/io-github-akoskomuves-appstoreconnect-mcp/asc-delete-app-event.md
- `asc_delete_app_event_localization` — Destructive — https://policylayer.com/tools/io-github-akoskomuves-appstoreconnect-mcp/asc-delete-app-event-localization.md
- `asc_delete_app_event_screenshot` — Destructive — https://policylayer.com/tools/io-github-akoskomuves-appstoreconnect-mcp/asc-delete-app-event-screenshot.md
- `asc_delete_app_event_video_clip` — Destructive — https://policylayer.com/tools/io-github-akoskomuves-appstoreconnect-mcp/asc-delete-app-event-video-clip.md
- `asc_delete_app_info_localization` — Destructive — https://policylayer.com/tools/io-github-akoskomuves-appstoreconnect-mcp/asc-delete-app-info-localization.md
- `asc_delete_app_preview` — Destructive — https://policylayer.com/tools/io-github-akoskomuves-appstoreconnect-mcp/asc-delete-app-preview.md
- `asc_delete_app_preview_set` — Destructive — https://policylayer.com/tools/io-github-akoskomuves-appstoreconnect-mcp/asc-delete-app-preview-set.md
- `asc_delete_app_screenshot` — Destructive — https://policylayer.com/tools/io-github-akoskomuves-appstoreconnect-mcp/asc-delete-app-screenshot.md
- `asc_delete_app_screenshot_set` — Destructive — https://policylayer.com/tools/io-github-akoskomuves-appstoreconnect-mcp/asc-delete-app-screenshot-set.md
- `asc_delete_app_store_version` — Destructive — https://policylayer.com/tools/io-github-akoskomuves-appstoreconnect-mcp/asc-delete-app-store-version.md
- `asc_delete_app_store_version_localization` — Destructive — https://policylayer.com/tools/io-github-akoskomuves-appstoreconnect-mcp/asc-delete-app-store-version-localization.md
- `asc_delete_app_store_version_phased_release` — Destructive — https://policylayer.com/tools/io-github-akoskomuves-appstoreconnect-mcp/asc-delete-app-store-version-phased-release.md
- `asc_delete_beta_app_localization` — Destructive — https://policylayer.com/tools/io-github-akoskomuves-appstoreconnect-mcp/asc-delete-beta-app-localization.md
- `asc_delete_beta_build_localization` — Destructive — https://policylayer.com/tools/io-github-akoskomuves-appstoreconnect-mcp/asc-delete-beta-build-localization.md
- `asc_delete_beta_feedback_crash_submission` — Destructive — https://policylayer.com/tools/io-github-akoskomuves-appstoreconnect-mcp/asc-delete-beta-feedback-crash-submission.md
- `asc_delete_beta_feedback_screenshot_submission` — Destructive — https://policylayer.com/tools/io-github-akoskomuves-appstoreconnect-mcp/asc-delete-beta-feedback-screenshot-submission.md
- `asc_delete_beta_group` — Destructive — https://policylayer.com/tools/io-github-akoskomuves-appstoreconnect-mcp/asc-delete-beta-group.md
- `asc_delete_beta_recruitment_criterion` — Destructive — https://policylayer.com/tools/io-github-akoskomuves-appstoreconnect-mcp/asc-delete-beta-recruitment-criterion.md
- `asc_delete_beta_tester` — Destructive — https://policylayer.com/tools/io-github-akoskomuves-appstoreconnect-mcp/asc-delete-beta-tester.md
- `asc_delete_customer_review_response` — Destructive — https://policylayer.com/tools/io-github-akoskomuves-appstoreconnect-mcp/asc-delete-customer-review-response.md
- `asc_delete_experiment_treatment` — Destructive — https://policylayer.com/tools/io-github-akoskomuves-appstoreconnect-mcp/asc-delete-experiment-treatment.md
- `asc_delete_iap_localization` — Destructive — https://policylayer.com/tools/io-github-akoskomuves-appstoreconnect-mcp/asc-delete-iap-localization.md
- `asc_delete_marketplace_search_detail` — Destructive — https://policylayer.com/tools/io-github-akoskomuves-appstoreconnect-mcp/asc-delete-marketplace-search-detail.md
- …and 247 more: https://policylayer.com/tools/io-github-akoskomuves-appstoreconnect-mcp.md

## For agents

This record is a snapshot. Live verdicts and the full registry:

- Check every server in your MCP config at once: `npx -y policylayer stack`
- Vet a server before you add it: install the mcp-precheck skill — `npx skills add https://policylayer.com` (skill text: https://policylayer.com/skill.md)
- Query the registry over MCP: endpoint `https://api.policylayer.com/mcp` — tools `check_mcp_server`, `check_mcp_stack`, `check_tool`, `search_registry`, `get_change_events`

---

Source: the PolicyLayer MCP registry — one continuously verified record per MCP server. Full record: https://policylayer.com/registry?q=io-github-akoskomuves-appstoreconnect-mcp · API: https://policylayer.com/registry/api · Policy library: https://policylayer.com/policies/io-github-akoskomuves-appstoreconnect-mcp