Plugins

The Plugins screen lets you list the plugins registered by manifest, install or uninstall them and read their deployment status. Portal path: /capabilities/plugins. Developers register plugins; tenant administrators install and uninstall them. The screen is drawn by portal/src/screens/capabilities.tsx.

What the screen shows

• Plugins table, read with GET /v1/plugins (every plugin in one call, by name). Columns: Name, Version, Verified, Status, Installed. Empty: No plugin, hint Apply a Plugin manifest below.
• The row menu View details shows every field of the row in a side panel.
• Apply a manifest panel prefilled with a Plugin manifest sample (portal/src/samples/plugin-manifest.json), with Reset example and Apply.

Actions

Button or action	What it does	API call	Roles
Refresh (icon)	Reloads the list.	GET /v1/plugins	Any tenant member
Row menu View details	Shows the row.	None	Any tenant member
Row menu Install (no Installed date)	Verifies the signature of the artifact, renders the deployment and its network policy, then marks the plugin installed (or failed).	POST /v1/plugins/{name}/install	tenant_admin and relation owner
Row menu Uninstall (an Installed date is set)	Opens Confirm a destructive action; type the plugin name, then Confirm.	GET /v1/lineage/graph, then POST /v1/plugins/{name}/uninstall	tenant_admin and relation owner
Row menu Status	Shows the plugin, version, status, verified flag, digest, installation date, runtime class, applied (applied on Kubernetes, rendered otherwise), deployment, network policy and error.	GET /v1/plugins/{name}/status	Relation viewer on the plugin
Reset example / Apply	Restores the sample / applies the Plugin manifest.	POST /v1/manifests/apply	tenant_admin, developer
Retry (error state)	Sends the failed read again.	Same call	Same roles

note

A manifest with spec.format: pack is refused with pack_requires_marketplace: a complete pack is published and installed through the Marketplace, see Installations.

Roles

The portal hides no button. In services/control-plane/src/eai/domains/plugins/routes.py: install and uninstall need tenant_admin and the relation owner; status and detail need the relation viewer; the list needs a tenant. Registering a plugin by manifest needs tenant_admin or developer. platform_admin passes every role check.

Typical tasks

Install a plugin

1. Apply the manifest. The manifest names the signed OCI artifact, its digest and its sandbox. In Apply a manifest, paste your Plugin manifest, then click Apply. Expected result: Manifest applied and the plugin in the table after Refresh. If it fails: invalid_manifest lists the field at fault (for example sandbox.egress_allowlist required with network: egress_allowlist).
2. Install it. Installation checks the signature again. In the row menu, click Install. Expected result: the toast Done, the status installed and an Installed date. If it fails: plugin_unsigned (403) means the signature is not valid; plugin_blocked (403) means the plugin is blocked.
3. Read the status. The status shows what was deployed. Click Status. Expected result: applied (or rendered when the Control Plane has no Kubernetes access), the deployment and the network policy, with no error. If it fails: read error and fix the sandbox section of the manifest.

Update an installed plugin

1. Uninstall it. An installed plugin cannot be replaced. Click Uninstall, type the name, then Confirm. Expected result: the toast Done and the status uninstalled; the deployment is removed. If it fails: plugin_not_installed (409) means it was already uninstalled; upstream_error (502) means Kubernetes refused the deletion.
2. Apply the new version. Apply the new manifest in Apply a manifest. Expected result: Manifest applied and the status Registered. If it fails: plugin_installed (409) means the plugin is still installed.
3. Install it again. The Installed date of the first installation stays on the row, so the row menu keeps Uninstall and hides Install. Send POST /v1/plugins/{name}/install from the SDK or the API. Expected result: the status installed after Refresh. If it fails: read the error code in the answer (plugin_unsigned, plugin_blocked).

Troubleshooting

Symptom	Cause	Fix
plugin_unsigned (403): "Plugin ... has no valid signature."	The artifact signature does not verify.	Sign the artifact and apply the manifest again.
plugin_blocked (403)	The plugin is blocked.	Ask a security officer.
plugin_installed (409): "Plugin ... is installed: uninstall it first."	You applied a manifest over an installed plugin.	Uninstall, apply, then install.
plugin_not_installed (409)	Uninstall on a plugin that is not installed (the row keeps its Installed date after an uninstall).	Read the Status column; nothing to do when it shows uninstalled.
pack_requires_marketplace (422)	The manifest describes a complete pack.	Publish and install it through the Marketplace.
forbidden (403)	You are not tenant_admin or not the owner of the plugin.	Ask a tenant administrator.
Status Failed after Install	The rendering or the deployment failed.	Read error with Status.

Related pages

• Plugin builder
• Skills
• Installations
• Plugin development guide
• Plugin registry brick
• Plugin runtime brick