`POST /api/v1/packages/install`: install a package, or update it.

POST 
/api/v1/packages/install

The preview is computed again and its refusal applies: an invalid signature, an unsigned package when governance requires a signature, an older version without allowDowngrade, an agent another package owns. Python dependencies need depsConfirmed; an update that adds accesses, required connections or MCP servers needs changesConfirmed. The MCP servers the package brings are added like POST /api/v1/mcp/servers adds one. The installation is recorded in the audit journal.

Request

Responses

201

Installed

400

The file cannot be read

403

A signed package is required, or the organisation policy does not trust its publisher

409

Older version, or agent owned elsewhere

422

Invalid package or signature, or MCP server refused

428

A confirmation is missing

500

Store, environment or journal failure

503

No audit journal, or no MCP manager for the servers it brings