Portal Community
InstallHub

Publishing Packages

Publish your BizFirst packages to the InstallHub marketplace so other organizations can discover, preview, and install your workflows, forms, and agents.

Phase 3 — PENDING The marketplace publishing pipeline is planned but not yet implemented. This guide documents the intended behavior.

Submission at a Glance

Publishing a package is a five-stage process. All stages complete without human intervention for Community-level packages. Certified packages add a human review stage after the automated checks.

1. Publisher
Verified
→
2. Package
Uploaded
→
3. Security
Scan
→
4. Review
(Automated)
→
5. Listed in
Marketplace

Trust Level Earned on Submission

Trust LevelHow EarnedReview TypeTypical Timeline
CommunityAutomated scan PASS + manifest validationAutomated only5–15 minutes
CertifiedCommunity + human review + 70% test coverage + full READMEAutomated + human2–5 business days
OfficialBizFirst engineering team onlyInternalInternal process

Submission API

POST /api/marketplace/submit
Authorization: Bearer {publisherToken}
Content-Type: multipart/form-data

Fields:
  package     — the .installhub.zip file
  description — short description (max 500 chars)
  category    — one of: Workflows, Forms, Agents, Templates, Utilities
  tags        — comma-separated tags (max 10)
  changelog   — release notes for this version
  requestCertification — true to enter the Certified review queue

// Response (immediate):
{
  "submissionId": "sub-a1b2c3d4",
  "status":       "Queued",
  "statusUrl":    "/api/marketplace/submissions/sub-a1b2c3d4/status",
  "estimatedMinutes": 10
}

Submission Status

GET /api/marketplace/submissions/{submissionId}/status

// Scanning:
{ "status": "SecurityScanning", "stage": "ExpressionInjectionCheck", "progress": "2 of 5 checks" }

// Listed:
{
  "status":      "Listed",
  "packageId":   "mkt-pkg-a1b2c3",
  "trustLevel":  "Community",
  "listedAt":    "2026-05-25T14:22:00Z",
  "marketplaceUrl": "https://marketplace.bizfirstai.com/packages/mkt-pkg-a1b2c3"
}

// Rejected:
{
  "status":  "Rejected",
  "reason":  "SecurityScanFailed",
  "details": "Expression injection detected in RuleSet 'ApprovalRules': unsafe expression '{{env.secret}}'",
  "resubmitAfterFix": true
}

Prerequisites Before Publishing

Next: Publisher Profile →