Pack catalog

The Pack catalog screen lets you browse the signed packs of the marketplace, read their version and SBOM, promote a version to production, suspend or resume a pack, run a preflight check before an install and manage the trusted publishers whose keys verify the signatures. Portal path: /marketplace/catalog. It is used by the tenant administrators and security officers (tenant_admin, security_officer); every member of the tenant reads the catalog.

What the screen shows

Three tabs; Preflight is shown only to tenant_admin and security_officer (ROLES.marketplaceAdmins).

Packages tab, with the filter Domain and Filter, then Refresh:

Column	Content
Name	Name of the pack.
Domain	Business domain of the pack.
Description	Description.
Owner	Owner of the pack.
Latest version	Last published version.
Updated	Date of the last change.

A click on a line opens a side panel with the pack read from the API. Empty state: No package, "Publish a signed pack with the SDK to see it here."

Preflight tab: form "Checks compatibility, signature, permissions and secret references before an install." with Package, Version, Environment, Approved permissions, Configuration, Secret references and a Result area.

Trusted publishers tab, with Refresh and Add publisher:

Column	Content
Name	Name of the publisher.
Algorithm	Signature algorithm of its key.
Status	active or revoked.
Scope	Scope of the key.
Created	Date of registration.

A click on a line shows it in a side panel. Empty state: No publisher.

Actions

Button or action	What it does	API call	Roles
Tab Packages, Domain then Filter	Reads the packs, optionally of one domain.	GET /v1/marketplace/packages	Member of the tenant
Click on a pack	Opens the detail panel.	GET /v1/marketplace/packages/{name}	Member of the tenant
Promote to production	Dialog Approval. Without approval identifier, the production gates are checked and a four eyes approval is opened (the answer gives its identifier); with the identifier of an approved request, the latest version is promoted.	POST /v1/marketplace/packages/{name}/versions/{version}/production	tenant_admin, security_officer
SBOM	Shows the SBOM of the latest version.	GET /v1/marketplace/packages/{name}/versions/{version}/sbom	Member of the tenant
Version details	Shows the latest version.	GET /v1/marketplace/packages/{name}/versions/{version}	Member of the tenant
Suspend the pack	Dialog Reason (required); immediate kill switch of the pack, which suspends its installations. Shown unless the pack is suspended.	POST /v1/marketplace/packages/{name}/status	tenant_admin, security_officer
Resume the pack	Dialog Approval, Reason; lifting a suspension goes through a four eyes approval. Shown for a suspended pack.	POST /v1/marketplace/packages/{name}/status	tenant_admin, security_officer
Tab Preflight, form then Run	Checks compatibility, signature, permissions and secret references; shows the report.	POST /v1/marketplace/preflight	tenant_admin, security_officer
Tab Trusted publishers, Refresh	Reads the publishers.	GET /v1/marketplace/publishers	Member of the tenant
Add publisher then Create	Form Name (required), Public key (required, PEM -----BEGIN PUBLIC KEY-----).	POST /v1/marketplace/publishers	tenant_admin, security_officer
Revoke (publisher)	Destructive confirmation; the packs signed with this key are no longer trusted. Shown unless revoked.	POST /v1/marketplace/publishers/{name}/revoke (impact: GET /v1/lineage/graph)	tenant_admin, security_officer

Roles

From services/control-plane/src/eai/domains/marketplace/routes.py: reading needs a principal inside a tenant; promotion, pack status and publishers require TRUST_ROLES (tenant_admin, security_officer); the preflight requires tenant_admin or security_officer. platform_admin passes every check. The portal hides the write actions and the Preflight tab for the other roles.

Typical tasks

Trust a new publisher

1. Add its key. Tab Trusted publishers > Add publisher: Name of the publisher, Public key in PEM, then Create. The key verifies the signature of every pack of this publisher. Expected result: a line with the status active. If it fails: publisher_invalid_key (HTTP 422) when the key cannot be read.

Check a pack before installing it

1. Read the version. Tab Packages, row menu > Version details, then SBOM. Expected result: two side panels with the manifest and the components. If it fails: marketplace_version_not_found (HTTP 404).
2. Run the preflight. Tab Preflight: Package, Version, Environment prod, Approved permissions (for example rag:query, tools:invoke), then Run. Expected result: the report with every check. If it fails: preflight_failed (HTTP 422) lists the failed checks; fix them before the install.

Promote a version to production

1. Request the promotion. Row menu > Promote to production, leave Approval empty, submit. Expected result: the answer with pending_approval and an approval identifier. If it fails: the answer lists the production gate that failed.
2. Have it approved, then apply. Other people decide the request in Approvals inbox; then run Promote to production again with the Approval identifier. Expected result: the promotion is applied. If it fails: the approval is not approved yet.

Troubleshooting

Symptom	Cause	Fix
No Preflight tab, no write action	Your role is neither tenant_admin nor security_officer.	Ask a tenant administrator.
preflight_failed (HTTP 422)	One check failed (compatibility, signature, permissions, secret references).	Read the failed checks in the details and fix them.
marketplace_package_not_found / marketplace_version_not_found (HTTP 404)	Unknown pack or version.	Check the name and Latest version.
publisher_invalid_key (HTTP 422)	The public key is not a valid PEM key.	Paste the whole PEM block.
publisher_not_found (HTTP 404)	Unknown publisher.	Click Refresh.
package_suspended (HTTP 409)	The pack is suspended by its kill switch.	Resume the pack after approval.
forbidden (HTTP 403)	The action needs tenant_admin or security_officer.	Ask one of these roles.

Related pages

• Marketplace guide
• Pack development
• Installations
• Change pipeline
• Approvals inbox