Plugin security

Editions: Open Source · Free Cloud · Pro

Console bundles

GET /system/plugin/manifest (cookie auth) returns plugin id, version, capabilities, activation, bundle URL, SHA-256, publisher, signature/official flags, and extension points.

Compiled JS loads only when all are true:

1. official=true
2. bundle signature/checksum validates (SHA-256 of the downloaded bytes)
3. plugin activated for the current project
4. route permission passes

Trust/integrity failures block the plugin and show diagnostics. They do not silently load.

Third-party plugins never execute JavaScript in Console. The host renders schema-based settings, actions, links, and status panels.

Project REST

Routes for project.rest mount at /{pluginId}{path} and require project id plus activation. System-only REST (system.rest without project.rest) stays unprefixed and is not activation-gated.

Pass X-Apito-Project-ID or project_id on project plugin REST calls.