InstallHub
Installing from Marketplace
Installing a marketplace package triggers the Phase 2 import pipeline in your tenant. The process is identical to a direct import — with the added step of downloading the package from PublicHub CDN.
Phase 3 — PENDING This feature is planned but not yet implemented.
Install API
POST /api/marketplace/packages/{packageId}/install
Authorization: Bearer {token}
{
"version": "3.0.0", // Optional — omit for latest
"targetTenantId": "tenant-abc123",
"defaultConflictStrategy": "Skip",
"dryRun": false
}
// Response:
{
"installId": "mkt-install-b7c8d9",
"status": "InProgress",
"statusUrl": "/api/marketplace/installs/mkt-install-b7c8d9/status",
"estimatedSeconds": 15
}Checking Install Status
GET /api/marketplace/installs/{installId}/status
// In progress:
{ "status": "InProgress", "stage": "Installing", "progress": "3 of 5 artifacts installed" }
// Complete:
{
"status": "Success",
"importId": "imp-f9a2c1e8-...",
"artifactsInstalled": 5,
"conflictsResolved": 1,
"completedAt": "2026-05-25T10:31:00Z"
}
// Failed:
{
"status": "Failed",
"stage": "SecurityScan",
"error": "SecurityScanFailed",
"message": "Package scan returned FAIL — installation blocked",
"rolledBack": true
}Permission Required
Installing a marketplace package requires:
installhub:import— base import permissionmarketplace:install— specific permission to install from marketplace- For Community packages:
marketplace:install:community— separate permission that can be restricted to senior administrators
Install Notifications
On completion, the installing user receives an in-app and email notification with the import result. If the install fails, the notification includes the error details and a link to the import audit log.
Trust Level Confirmation
For Community-level packages, the install API requires explicit acknowledgment of the trust level:
{
"version": "1.0.0",
"targetTenantId": "tenant-abc123",
"acknowledgeCommunityPackage": true // Required for Community packages
}Omitting this field when installing a Community package returns:
HTTP 400
{ "error": "AcknowledgmentRequired", "message": "This is a Community package. Set 'acknowledgeCommunityPackage': true to confirm." }