Install an add-on
Installs a catalog add-on at a scope: org, project, sandbox or atlas_workspace. Every install passes the same checks, in this order, each refusal with its code. The listing exists and the caller can see it in the org's catalog (addon_not_found otherwise), and the caller holds the kind's .manage at the scope (skills.manage, mcp.manage: at the org, on the project, or on the sandbox's project). Only then: the listing is not blocked or retired; the scope is one of its attachLevels; the org's policy allows it (community add-ons need the org's opt-in or an explicit allow); the org holds it (free, included in its plan, or bought: installing never buys); and nothing above the scope has switched it off. Today skills and MCP servers install on a project, one install of a listing per project. A resource is allocated, on a project (the default for its sandboxes) or one sandbox, by config.quantity, under resources.manage on the project (a sandbox's own project); posting again for the same scope changes its quantity. After the checks above, an allocation also needs, in this order: a quantity; a sandbox no more than its project's default (resource_exceeds_project); the org's allocations of the resource within what it bought (resource_quantity_exceeded); the plan's cap for it, and a plan with none refuses (resource_quota_not_set, resource_quota_exceeded); for a resource billed on use, the org's own cap (resource_org_cap_not_set, resource_org_cap_exceeded); and room on a host (addon_capacity_unavailable, 503). Plugins are not installable yet (501), every install and allocation is audited, and apps are added to an Atlas workspace from Atlas.
Authorization
bearerAuth A RemoteHost API key (rh_sk_...) or a user session token.
In: header
Path Parameters
Request Body
application/json
TypeScript Definitions
Use the request body type in TypeScript.
Response Body
application/json
application/json
application/json
application/json
application/json
application/json
application/json
application/json
application/json
application/json
application/json
curl -X POST "https://example.com/orgs/string/addons/string/installs" \ -H "Content-Type: application/json" \ -d '{ "scope": { "type": "org", "id": "string" } }'{ "install": { "id": "string", "kind": "skill", "scope": { "type": "project", "id": "string" }, "projectId": "string", "quantity": 0, "unit": "string", "listingId": "string", "listing": { "id": "string", "slug": "string", "name": "string", "provenance": "first_party", "status": "string" }, "name": "string", "enabled": true, "status": "string", "held": true, "holding": "held_free", "policy": { "setting": "allow", "allowed": true }, "createdAt": "string", "updatedAt": "string" }}Opt an organization in to community add-ons, or out PUT
Community add-ons are unreviewed third-party code and servers that run beside the org's secrets, so they are off until an owner or admin opts in. Needs `integrations.manage`. Audited.
Remove an installed add-on DELETE
Removes one install of the listing, or releases a resource's allocation (`installId` is its id). Needs the same permission as installing it; removing is allowed whatever the listing's state, the org's policy or holding. A caller who cannot read the kind on the install's project gets the same 404 whether or not it exists. Audited.