curl --request POST \
--url https://api.example.com/api/marketplace/install \
--header 'Content-Type: application/json' \
--header 'x-api-key: <api-key>' \
--data '
{
"ref": "<string>",
"accept_public_routes": false,
"env": {},
"route_mounts": {},
"secret_keys": [
"<string>"
],
"version": "<string>"
}
'import requests
url = "https://api.example.com/api/marketplace/install"
payload = {
"ref": "<string>",
"accept_public_routes": False,
"env": {},
"route_mounts": {},
"secret_keys": ["<string>"],
"version": "<string>"
}
headers = {
"x-api-key": "<api-key>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {'x-api-key': '<api-key>', 'Content-Type': 'application/json'},
body: JSON.stringify({
ref: '<string>',
accept_public_routes: false,
env: {},
route_mounts: {},
secret_keys: ['<string>'],
version: '<string>'
})
};
fetch('https://api.example.com/api/marketplace/install', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.example.com/api/marketplace/install",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'ref' => '<string>',
'accept_public_routes' => false,
'env' => [
],
'route_mounts' => [
],
'secret_keys' => [
'<string>'
],
'version' => '<string>'
]),
CURLOPT_HTTPHEADER => [
"Content-Type: application/json",
"x-api-key: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.example.com/api/marketplace/install"
payload := strings.NewReader("{\n \"ref\": \"<string>\",\n \"accept_public_routes\": false,\n \"env\": {},\n \"route_mounts\": {},\n \"secret_keys\": [\n \"<string>\"\n ],\n \"version\": \"<string>\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("x-api-key", "<api-key>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.example.com/api/marketplace/install")
.header("x-api-key", "<api-key>")
.header("Content-Type", "application/json")
.body("{\n \"ref\": \"<string>\",\n \"accept_public_routes\": false,\n \"env\": {},\n \"route_mounts\": {},\n \"secret_keys\": [\n \"<string>\"\n ],\n \"version\": \"<string>\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.example.com/api/marketplace/install")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["x-api-key"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"ref\": \"<string>\",\n \"accept_public_routes\": false,\n \"env\": {},\n \"route_mounts\": {},\n \"secret_keys\": [\n \"<string>\"\n ],\n \"version\": \"<string>\"\n}"
response = http.request(request)
puts response.read_body{
"data": {
"advisories": [
"<unknown>"
],
"notes": [
"<string>"
],
"package": "<string>",
"pip_output": "<string>",
"ref": "<string>",
"reload": {
"env_keys": 123,
"fanout": {
"mode": "<string>",
"error": "<string>",
"local_only": true,
"note": "<string>",
"op": "<string>",
"reachable": true,
"results": [
{
"name": "<string>",
"outcome": "<string>",
"detail": "<string>",
"error": "<string>",
"payload": null
}
]
},
"status": "<string>"
},
"routes": [
{
"full_path": "<string>",
"item": "<string>",
"methods": [
"<string>"
],
"public": true
}
],
"version": "<string>"
}
}{
"error": "<string>",
"code": "<string>"
}{
"error": "<string>",
"code": "<string>"
}{
"error": "<string>",
"code": "<string>"
}{
"error": "<string>",
"code": "<string>"
}{
"error": "<string>",
"code": "<string>"
}{
"error": "<string>",
"code": "<string>"
}{
"error": "<string>",
"code": "<string>"
}{
"error": "reloading — the server is applying a config reload; retry shortly",
"reloading": true
}Install a marketplace plugin
Resolve, pip install (nothing for a descriptor-only plugin), patch the manifest,
reload, and record attribution — aborting and unwinding on any failure (see
:meth:Installer.install). When the spec declares install-time env env /
secret_keys satisfy the required !ENV markers or connector-env in the same
combined transaction. route_mounts remaps declared route bases;
accept_public_routes acknowledges public routes. The result’s routes lists
every route the install mounted.
curl --request POST \
--url https://api.example.com/api/marketplace/install \
--header 'Content-Type: application/json' \
--header 'x-api-key: <api-key>' \
--data '
{
"ref": "<string>",
"accept_public_routes": false,
"env": {},
"route_mounts": {},
"secret_keys": [
"<string>"
],
"version": "<string>"
}
'import requests
url = "https://api.example.com/api/marketplace/install"
payload = {
"ref": "<string>",
"accept_public_routes": False,
"env": {},
"route_mounts": {},
"secret_keys": ["<string>"],
"version": "<string>"
}
headers = {
"x-api-key": "<api-key>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {'x-api-key': '<api-key>', 'Content-Type': 'application/json'},
body: JSON.stringify({
ref: '<string>',
accept_public_routes: false,
env: {},
route_mounts: {},
secret_keys: ['<string>'],
version: '<string>'
})
};
fetch('https://api.example.com/api/marketplace/install', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.example.com/api/marketplace/install",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'ref' => '<string>',
'accept_public_routes' => false,
'env' => [
],
'route_mounts' => [
],
'secret_keys' => [
'<string>'
],
'version' => '<string>'
]),
CURLOPT_HTTPHEADER => [
"Content-Type: application/json",
"x-api-key: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.example.com/api/marketplace/install"
payload := strings.NewReader("{\n \"ref\": \"<string>\",\n \"accept_public_routes\": false,\n \"env\": {},\n \"route_mounts\": {},\n \"secret_keys\": [\n \"<string>\"\n ],\n \"version\": \"<string>\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("x-api-key", "<api-key>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.example.com/api/marketplace/install")
.header("x-api-key", "<api-key>")
.header("Content-Type", "application/json")
.body("{\n \"ref\": \"<string>\",\n \"accept_public_routes\": false,\n \"env\": {},\n \"route_mounts\": {},\n \"secret_keys\": [\n \"<string>\"\n ],\n \"version\": \"<string>\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.example.com/api/marketplace/install")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["x-api-key"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"ref\": \"<string>\",\n \"accept_public_routes\": false,\n \"env\": {},\n \"route_mounts\": {},\n \"secret_keys\": [\n \"<string>\"\n ],\n \"version\": \"<string>\"\n}"
response = http.request(request)
puts response.read_body{
"data": {
"advisories": [
"<unknown>"
],
"notes": [
"<string>"
],
"package": "<string>",
"pip_output": "<string>",
"ref": "<string>",
"reload": {
"env_keys": 123,
"fanout": {
"mode": "<string>",
"error": "<string>",
"local_only": true,
"note": "<string>",
"op": "<string>",
"reachable": true,
"results": [
{
"name": "<string>",
"outcome": "<string>",
"detail": "<string>",
"error": "<string>",
"payload": null
}
]
},
"status": "<string>"
},
"routes": [
{
"full_path": "<string>",
"item": "<string>",
"methods": [
"<string>"
],
"public": true
}
],
"version": "<string>"
}
}{
"error": "<string>",
"code": "<string>"
}{
"error": "<string>",
"code": "<string>"
}{
"error": "<string>",
"code": "<string>"
}{
"error": "<string>",
"code": "<string>"
}{
"error": "<string>",
"code": "<string>"
}{
"error": "<string>",
"code": "<string>"
}{
"error": "<string>",
"code": "<string>"
}{
"error": "reloading — the server is applying a config reload; retry shortly",
"reloading": true
}Authorizations
Body
Install a marketplace plugin by ref, optionally pinning a version.
env / secret_keys are accepted for an install whose spec declares
install-time env (an mcp entry's required !ENV markers or an oauth connector's
client-credential env): these values are written to the env store in the same
transaction that writes the provides entry (never deferred), and secret_keys
marks the given keys secret (appended to TAI_ENV_SECRET_KEYS; an oauth
connector's client secret is masked by derivation with no mark needed). Declared on
the model so a Studio body carrying them is not silently dropped (pydantic ignores
unknown fields).
route_mounts remaps a route-carrying item's declared base ({item_name: base}); accept_public_routes acknowledges that the install's public routes
answer WITHOUT authentication (required when any public route is declared).
Response
Success.
The install (and update) receipt. package is null for a descriptor-only
plugin; advisories are the target's upstream advisory rows forwarded verbatim;
notes are activation notes; reload is the manifest apply's fleet result;
pip_output is null for a descriptor-only plugin; routes lists every route
the operation mounted.
Show child attributes
Show child attributes

