`POST /api/v1/packages/install`: install a package, or update it.
POST/api/v1/packages/install
The preview is computed again and its refusal applies: an invalid
signature, an unsigned package when governance requires a signature, an
older version without allowDowngrade, an agent another package owns.
Python dependencies need depsConfirmed; an update that adds accesses,
required connections or MCP servers needs changesConfirmed. The MCP
servers the package brings are added like POST /api/v1/mcp/servers
adds one. The installation is recorded in the audit journal.
Request
Responses
- 201
- 400
- 403
- 409
- 422
- 428
- 500
- 503
Installed
The file cannot be read
A signed package is required, or the organisation policy does not trust its publisher
Older version, or agent owned elsewhere
Invalid package or signature, or MCP server refused
A confirmation is missing
Store, environment or journal failure
No audit journal, or no MCP manager for the servers it brings