Submitting a Package

Submit API

POST /api/marketplace/submit
Authorization: Bearer {publisherToken}
Content-Type: multipart/form-data

// Form fields:
package              — (file) The .installhub.zip package
description          — Short description shown in marketplace search results (max 500 chars)
category             — Package category (see Category Values below)
tags                 — Comma-separated list of tags, max 10, max 30 chars each
changelog            — Release notes for this version (max 5000 chars)
requestCertification — "true" to enter the Certified review queue (optional, default false)

// Response — HTTP 202 Accepted:
{
  "submissionId":      "sub-a1b2c3d4",
  "packageId":         "mkt-pkg-a1b2c3",   // Assigned on first submission; reused for new versions
  "version":           "3.0.0",
  "status":            "Queued",
  "trustLevelTarget":  "Community",         // Or "Certified" if requestCertification=true
  "statusUrl":         "/api/marketplace/submissions/sub-a1b2c3d4/status",
  "estimatedMinutes":  10
}

Category Values

Submission Status Lifecycle

GET /api/marketplace/submissions/{submissionId}/status

// Status values and transitions:
// Queued → SecurityScanning → ManifestValidation → [HumanReview] → Listed / Rejected

// During scan:
{
  "status":   "SecurityScanning",
  "stage":    "ExpressionInjectionCheck",
  "progress": "2 of 5 checks complete"
}

// During manifest validation:
{
  "status":   "ManifestValidation",
  "stage":    "ReadmeCompletenessCheck"
}

// Awaiting human review (Certified path only):
{
  "status":          "AwaitingHumanReview",
  "estimatedDays":   3,
  "reviewQueuePosition": 7
}

// Successfully listed:
{
  "status":         "Listed",
  "packageId":      "mkt-pkg-a1b2c3",
  "trustLevel":     "Community",
  "listedAt":       "2026-05-25T14:22:00Z",
  "marketplaceUrl": "https://marketplace.bizfirstai.com/packages/mkt-pkg-a1b2c3"
}

// Rejected:
{
  "status":  "Rejected",
  "reason":  "SecurityScanFailed",
  "details": "Expression injection detected in ProcessDefinition 'EmployeeOnboarding': expression contains environment variable access",
  "scanReport": "/api/marketplace/submissions/sub-a1b2c3d4/scan-report",
  "resubmitAfterFix": true
}

Submission Constraints

Listing Your Submissions

GET /api/marketplace/publishers/{publisherId}/submissions?status=Rejected

{
  "items": [
    {
      "submissionId": "sub-a1b2c3d4",
      "packageId":    "mkt-pkg-a1b2c3",
      "version":      "3.0.0",
      "status":       "Rejected",
      "reason":       "SecurityScanFailed",
      "submittedAt":  "2026-05-25T14:00:00Z"
    }
  ]
}

Error Responses