resolveMarketplacePackage

POST

/api/v1/plugin-store/{packageId}/resolve

const url = 'https://example.com/api/v1/plugin-store/example/resolve';
const options = {method: 'POST', headers: {cookie: 'tilecast_session=<tilecast_session>'}};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request POST \
  --url https://example.com/api/v1/plugin-store/example/resolve \
  --cookie tilecast_session=<tilecast_session>

Requires the Owner or Administrator role with the admin scope. Cookie requests additionally require the X-CSRF-Token header. Resolves a cached marketplace listing to its install review: the pinned artifact verifies provenance, pulls by digest, and reads the published manifest, which is authoritative for capabilities. Installs nothing; installing re-resolves fresh.

Authorizations

sessionCookie
userBearer

Parameters

Path Parameters

packageId

required

string

/^[a-z][a-z0-9_.:-]{0,127}$/

Store package identifier such as countdown_bar.

Header Parameters

X-CSRF-Token

string

Cookie-backed browser requests only, and only on unsafe methods. Bearer grants never send it.

Responses

200

Install review

application/json

object

data

required

The install review for a resolved repository: identity, version, provenance, and installed state. Resolving persists nothing.

object

packageId

required

string

version

required

string

manifest

required

The human-readable face of an installed or resolved package manifest.

object

name

required

string

description

required

string

publisherId

required

string

publisherName

required

string

license

required

string

tilecastRange

required

string

compatible

required

boolean

contributions

required

Array<object>

object

type

required

string

path

required

string

Package-qualified contribution ID read from the artifact’s nested manifest. Present on update checks, which read the artifact; absent when the review resolved only the published manifest.

string

playerRuntime

Verified external Player surface permissions. Present for executable plugin contributions.

object

surfaces

required

Array<string>

>= 1 items <= 7 items unique items

Allowed values: strip.top strip.bottom corner.top-left corner.top-right corner.bottom-left corner.bottom-right overlay

tier

required

string

Allowed values: emergency live scheduled ambient

runtime

External server behavior module (manifest version 2 only).

object

module

required

Package-relative WebAssembly module path.

string

capabilities

Bounded capabilities the package requests. Every entry is a request the host reviews before installation; nothing here grants itself.

object

network

Approved outbound HTTPS origins.

object

hosts

required

Array<string>

background

Package-owned background jobs the host runs.

object

jobs

required

Array<object>

object

required

string

intervalMinutes

required

integer

realtime

One bounded high-frequency background job, separately reviewed.

object

jobs

required

Array<object>

>= 1 items <= 1 items

object

required

string

intervalSeconds

required

integer

>= 5 <= 60

storage

Request plugin-owned key/value storage.

boolean

studioUI

Sandboxed Studio UI entry.

object

entry

required

string

services

Requested Tilecast service grants with registry-resolved display metadata.

Array<object>

object

required

string

version

required

integer

name

required

string

description

required

string

category

required

string

Allowed values: read directory manage audit

operations

required

Array<object>

object

name

required

string

title

required

string

description

required

string

mutating

required

boolean

digest

required

Pinned artifact digest as sha256 colon hex.

string

registry

required

string

releaseTag

required

string

releaseName

string

publishedAt

string format: date-time

owner

required

string

repo

required

string

repositoryUrl

required

string format: uri

signer

string

trust

required

string

installed

required

boolean

installedVersion

string

Example

{
  "data": {
    "contributions": [
      {
        "playerRuntime": {
          "surfaces": [
            "strip.top"
          ],
          "tier": "emergency"
        }
      }
    ],
    "capabilities": {
      "services": [
        {
          "category": "read"
        }
      ]
    }
  }
}

401

Dashboard authentication required

403

Owner or Administrator role required

404

Plugin_not_found — no listing carries this package ID

422

Repository_not_supported, no_published_package, package_unsigned, artifact_invalid, package_mismatch, or package_incompatible

502

Upstream_unavailable — the catalog, the registry, or Sigstore is unreachable