The manifest is the declarative contract for an app/plugin — identity, capabilities, scopes, and Store hints. Platform rejects installs that diverge from the signed manifest version.
Required top-level fields (structure)
| Field | Purpose |
|---|---|
id / slug |
Stable app identifier |
name |
Display name |
version |
Semver of this manifest |
publisher |
Publisher org id |
runtime |
hosted | https endpoint config |
scopes |
Requested OAuth / install scopes |
capabilities |
UI slots, actions, events |
webhooks |
Event subscriptions |
store |
Listing defaults (category, privacy) |
Example (placeholder)
{
"slug": "rfx-aging-alerts",
"name": "RFX aging alerts",
"version": "0.1.0",
"runtime": {
"type": "https",
"base_url": "https://apps.example.com/tradeics/rfx-aging"
},
"scopes": ["s2p:read"],
"capabilities": {
"ui": [{ "slot": "s2p.rfx.list.toolbar", "entry": "/ui/toolbar" }],
"actions": [{ "id": "scan_aging", "title": "Scan aging RFXs" }]
},
"webhooks": ["rfx.updated"],
"store": {
"visibility": "private",
"pricing": "free"
}
}Versioning rules
- Additive capabilities: minor bump.
- Scope expansion: requires re-consent on install.
- Breaking handler URLs: major bump + migration notes.