Install a community plugin from an approved download URL
POST/plugins/api/plugins/install
Downloads the zip, verifies its SHA-256 against approved-plugins.json, validates the archive, and extracts it into src/plugins/community/{id}. The plugin is NOT enabled automatically — admins must review and click Enable.
Request
Responses
- 200
- 400
- 401
- 403
- 409
- 500
Plugin installed (not yet enabled)
Validation failure (unknown URL, checksum mismatch, unsafe zip)
Unauthorized
Forbidden — Admin role required
Plugin already installed
Install failed