Skip to content
Tilecast Docs

resolveGitHubRepository

POST
/api/v1/plugin-store/resolve-github
curl --request POST \
  --url https://example.com/api/v1/plugin-store/resolve-github \
  --header 'Content-Type: application/json' \
  --cookie tilecast_session=<tilecast_session> \
  --data '{ "repository": "https://example.com" }'

Requires the Owner or Administrator role with the admin scope. Cookie requests additionally require the X-CSRF-Token header. Resolves a public GitHub repository URL to its install review: the published manifest, the pinned digest, provenance, and installed state. Persists nothing; installing re-resolves fresh.

Authorizations

Section titled “Authorizations”

Parameters

Section titled “ Parameters ”

Header Parameters

Section titled “Header Parameters”
X-CSRF-Token
string

Cookie-backed browser requests only, and only on unsafe methods. Bearer grants never send it.

Request Bodyrequired

Section titled “Request Bodyrequired”
Media typeapplication/json
object
repository
required

Public GitHub repository URL.

string format: uri
Examplegenerated
{
  "repository": "https://example.com"
}

Responses

Section titled “ Responses ”

200

Section titled “200”

Install review

Media typeapplication/json
object
data
required

The install review for a resolved repository: identity, version, provenance, and installed state. Resolving persists nothing.

object
packageId
required
string
version
required
string
manifest
required

The human-readable face of an installed or resolved package manifest.

object
name
required
string
description
required
string
publisherId
required
string
publisherName
required
string
license
required
string
tilecastRange
required
string
compatible
required
boolean
contributions
required
Array<object>
object
type
required
string
path
required
string
id

Package-qualified contribution ID read from the artifact’s nested manifest. Present on update checks, which read the artifact; absent when the review resolved only the published manifest.

string
playerRuntime

Verified external Player surface permissions. Present for executable plugin contributions.

object
surfaces
required
Array<string>
>= 1 items <= 7 items unique items
Allowed values: strip.top strip.bottom corner.top-left corner.top-right corner.bottom-left corner.bottom-right overlay
tier
required
string
Allowed values: emergency live scheduled ambient
runtime

External server behavior module (manifest version 2 only).

object
module
required

Package-relative WebAssembly module path.

string
capabilities

Bounded capabilities the package requests. Every entry is a request the host reviews before installation; nothing here grants itself.

object
network

Approved outbound HTTPS origins.

object
hosts
required
Array<string>
background

Package-owned background jobs the host runs.

object
jobs
required
Array<object>
object
id
required
string
intervalMinutes
required
integer
realtime

One bounded high-frequency background job, separately reviewed.

object
jobs
required
Array<object>
>= 1 items <= 1 items
object
id
required
string
intervalSeconds
required
integer
>= 5 <= 60
storage

Request plugin-owned key/value storage.

boolean
studioUI

Sandboxed Studio UI entry.

object
entry
required
string
services

Requested Tilecast service grants with registry-resolved display metadata.

Array<object>
object
id
required
string
version
required
integer
name
required
string
description
required
string
category
required
string
Allowed values: read directory manage audit
operations
required
Array<object>
object
name
required
string
title
required
string
description
required
string
mutating
required
boolean
digest
required

Pinned artifact digest as sha256 colon hex.

string
registry
required
string
releaseTag
required
string
releaseName
string
publishedAt
string format: date-time
owner
required
string
repo
required
string
repositoryUrl
required
string format: uri
signer
string
trust
required
string
installed
required
boolean
installedVersion
string
Example
{
  "data": {
    "contributions": [
      {
        "playerRuntime": {
          "surfaces": [
            "strip.top"
          ],
          "tier": "emergency"
        }
      }
    ],
    "capabilities": {
      "services": [
        {
          "category": "read"
        }
      ]
    }
  }
}

400

Section titled “400”

Invalid_repository — not a GitHub repository URL

401

Section titled “401”

Dashboard authentication required

403

Section titled “403”

Owner or Administrator role required

404

Section titled “404”

Repository_not_found — GitHub has no such repository

422

Section titled “422”

Repository_private, no_published_release, manifest_not_found, manifest_invalid, release_tag_unusable, no_published_package, package_unsigned, artifact_invalid, package_mismatch, or package_incompatible

502

Section titled “502”

Upstream_unavailable — GitHub, the registry, or Sigstore is unreachable