Home Docs Claude Developer Platform 4 Nov 2026

One change · api

plugins-api changedmanage-claude/plugins-api

Nearest release: v2.1.318, published 4 hours before this site recorded the change. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.

Recorded here 4 Nov 2026 02:07 UTC

Lines+78added

Lines−73removed

From line 6 where the diff opens

First seen 1 Oct 2026 this site's first read of the page

Recorded edits14to this page, all time

The whole hunk

from line 6, old and new numbered

lines

from line 6

77The Plugins API lets you do the following:

9* Inventory every plugin in your Claude Enterprise organization

9* Inventory the plugins in your Claude Enterprise organization

1010* Publish plugins and new versions from your own pipelines

1111* Choose which version members are served

1212* Control who can use each plugin

from line 33

3333

3434| Resource | Endpoints |

3535| ------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |

36| **Plugins:** list every plugin in the organization, upload a new one, look one up, choose the version members are served (roll back or promote), delete one | `GET /v1/organizations/plugins` `POST /v1/organizations/plugins` `GET /v1/organizations/plugins/{plugin_id}` `POST /v1/organizations/plugins/{plugin_id}` `DELETE /v1/organizations/plugins/{plugin_id}` |

36| **Plugins:** list the plugins in the organization, upload a new one, look one up, choose the version members are served (roll back or promote), delete one | `GET /v1/organizations/plugins` `POST /v1/organizations/plugins` `GET /v1/organizations/plugins/{plugin_id}` `POST /v1/organizations/plugins/{plugin_id}` `DELETE /v1/organizations/plugins/{plugin_id}` |

3737| **Plugin versions:** list a plugin’s version history, upload a new version, look one up, download a version’s files | `GET /v1/organizations/plugins/{plugin_id}/versions` `POST /v1/organizations/plugins/{plugin_id}/versions` `GET /v1/organizations/plugins/{plugin_id}/versions/{version}` `GET /v1/organizations/plugins/{plugin_id}/versions/{version}/content` |

3838| **Installation settings:** read who can use an organization-owned plugin, set it for the whole organization or for one group, remove either setting | `GET /v1/organizations/plugins/{plugin_id}/installation_settings` `POST /v1/organizations/plugins/{plugin_id}/installation_settings/{target}` `DELETE /v1/organizations/plugins/{plugin_id}/installation_settings/{target}` |

3939| **Shares:** read who a member has shared their own plugin with (read-only) | `GET /v1/organizations/plugins/{plugin_id}/shares` |

4040| **Plugin marketplaces:** find a marketplace’s ID, look one up, set the default installation setting for its plugins, check marketplace content before connecting it | `GET /v1/organizations/plugin_marketplaces` `GET /v1/organizations/plugin_marketplaces/{marketplace_id}` `POST /v1/organizations/plugin_marketplaces/{marketplace_id}` `POST /v1/organizations/plugin_marketplaces/validate_repository` `POST /v1/organizations/plugin_marketplaces/validate_archive` |

4141

42This release does not include standalone skills (skills a member writes in the skills editor or uploads as a single skill in claude.ai). They do not appear in the inventory and cannot be created here. Plugins that Anthropic publishes are not inventoried either; their usage is reported by the [Analytics APIs](https://platform.claude.com/docs/en/manage-claude/analytics-api). Marketplaces are created, connected to repositories, and deleted in claude.ai, not through this API.

42Plugins that Anthropic publishes are not inventoried; their usage is reported by the [Analytics APIs](https://platform.claude.com/docs/en/manage-claude/analytics-api). Marketplaces are created, connected to repositories, and deleted in claude.ai, not through this API.

4343

4444## Prerequisites

4545

4646* Your organization must be on a Claude Enterprise plan.

4747* Your primary owner creates an Admin API key with the `read:plugins` scope, the `write:plugins` scope, or both in [claude.ai > Organization settings > API](https://claude.ai/admin-settings/api-access). See [Create a key for a Claude Enterprise organization](https://platform.claude.com/docs/en/manage-claude/admin-api-keys#create-a-key-for-a-claude-enterprise-organization).

48* Every request carries three headers: `x-api-key`, `anthropic-version: 2023-06-01`, and `anthropic-beta: ce-plugins-2026-09-01`.

48* Every request carries three headers: `x-api-key`, `anthropic-version: 2026-10-21`, and `anthropic-beta: ce-plugins-2026-09-01`.

4949

5050In Python, TypeScript, C#, Go, Java, PHP, and Ruby, the SDK exposes these endpoints under `client.beta.organization` (csharp, go: `client.Beta.Organization`; java: `client.beta().organization()`; php: `$client->beta->organization`), and the [`ant` CLI](https://platform.claude.com/docs/en/cli-sdks-libraries/cli/quickstart) under `ant beta:organization`; they send the `anthropic-version` and `anthropic-beta` headers for you. The examples on this page read the Admin API key from the `ANTHROPIC_API_KEY` environment variable. Where an SDK or the CLI fetches more pages for you, `limit` sets the page size, not the total (see [Pagination](https://platform.claude.com/docs/en/manage-claude/plugins-api#pagination)).

5151

from line 59

5959 ```bash cURL

6060 curl "https://api.anthropic.com/v1/organizations/plugins?owner_type=organization&limit=20" \

6161 -H "x-api-key: $ANTHROPIC_API_KEY" \

62 -H "anthropic-version: 2023-06-01" \

62 -H "anthropic-version: 2026-10-21" \

6363 -H "anthropic-beta: ce-plugins-2026-09-01"

6464 ```

6565

from line 223

223223

224224### Reading another organization under the same parent

225225

226`read:plugins` and `write:plugins` keys read and write only the organization they were created in. If your company has several Claude organizations linked under one parent organization, the parent’s primary owner can create a `read:org_audit` or `read:compliance_org_data` key for all linked organizations (see [Create a key for a Claude Enterprise organization](https://platform.claude.com/docs/en/manage-claude/admin-api-keys#create-a-key-for-a-claude-enterprise-organization)). That key can also read any linked organization that has access to this API. To read one, pass its ID in the `organization_id` query parameter on any `GET` endpoint on this page. The ID is the organization UUID shown in claude.ai’s settings (its `org_`-prefixed form is accepted too). Without the parameter, the key reads the organization it was created in. A `404` means the named organization is not under the key’s parent or the API is not available to it; a value that is not a UUID or `org_` ID returns `400`. Any other key that names an organization other than its own gets `404`. Writes do not accept `organization_id`.

226`read:plugins` and `write:plugins` keys read and write only the organization they were created in. Some companies have several Claude organizations linked under one parent organization. A `read:org_audit` or `read:compliance_org_data` [key created for all linked organizations](https://platform.claude.com/docs/en/manage-claude/admin-api-keys#create-a-key-for-a-claude-enterprise-organization) can also read any linked organization that has access to this API. To read one, pass its ID in the `organization_id` query parameter on any `GET` endpoint on this page. The ID is the organization UUID shown in claude.ai’s settings (its `org_`-prefixed form is accepted too). Without the parameter, the key reads the organization it was created in. A key with no organization of its own must always pass `organization_id`. A `404` means the named organization is not under the key’s parent or the API is not available to it; a value that is not a UUID or `org_` ID returns `400`. Any other key that names an organization other than its own gets `404`. Writes do not accept `organization_id`.

227227

228228## Key concepts

229229

from line 324

324324

325325`reach` summarizes, in one value, how far a version reaches on members’ machines and beyond:

326326

327| Value | Meaning |

328| ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |

329| `remote` | Declares an MCP server or a CLI, whatever else it declares. |

330| `privileged` | Declares no MCP server or CLI, but declares a hook, a monitor (a background command that keeps running during a session), an LSP (Language Server Protocol) server, or settings the plugin applies to the member’s app, or contains a skill, command, or any other Markdown file whose frontmatter pre-approves tools (`allowed-tools`). These run, or take effect, on the member’s own computer. |

331| `contained` | Declares no MCP server, CLI, hook, monitor, LSP server, or app settings, and none of its Markdown files pre-approves tools (for example, a plugin that holds only skills, commands, and agents, none with `allowed-tools`). |

327| Value | Meaning |

329| `remote` | Declares an MCP server or a CLI, whatever else it declares. |

330| `privileged` | Declares no MCP server or CLI, but declares a hook, a monitor (a background command that keeps running during a session), an LSP (Language Server Protocol) server, a workflow (a script that Claude Code can run; any file in a `workflows/` folder at the plugin’s root counts as one), or settings the plugin applies to the member’s app, or contains a skill, command, or any other Markdown file whose frontmatter pre-approves tools (`allowed-tools`). These run, or take effect, on the member’s own computer. |

331| `contained` | Declares no MCP server, CLI, hook, monitor, LSP server, workflow, or app settings, and none of its Markdown files pre-approves tools (for example, a plugin that holds only skills, commands, and agents, none with `allowed-tools`). |

332332

333`reach` counts everything the version declares, including monitors, LSP servers, and app settings, which `components` does not list, so a version with an empty `components` list can still be `privileged`. It is `null` for a version stored before components were recorded, and for a version whose reach could not be determined because the `SKILL.md` of one of its skills, or one of its command files, could not be read; treat `null` as unclassified.

333`reach` counts everything the version declares, including monitors, LSP servers, workflows, and app settings, which `components` does not list, so a version with an empty `components` list can still be `privileged`. It is `null` for a version stored before components were recorded, and for a version whose reach could not be determined because the `SKILL.md` of one of its skills, or one of its command files, could not be read; treat `null` as unclassified. The value is normally worked out when a version is stored, under the rules of that time. An older version can therefore be `contained` where the same files stored today would be `privileged`.

334334

335335### Upload requirements

336336

from line 338

338338

339339* The upload is either one `.zip` or `.plugin` archive, or a set of individual files. An archive may wrap everything in one top-level folder.

340340* It must contain exactly one manifest, at `.claude-plugin/plugin.json`, which must declare a `name`. A bare `SKILL.md` without a manifest is rejected.

341* A top-level `SKILL.md` whose frontmatter declares plugin components is merged into the manifest; `plugin.json` wins wherever both set a value.

341* A top-level `SKILL.md` whose frontmatter declares plugin components is merged into the manifest; `plugin.json` wins wherever both set a value. A `description` that the manifest takes from that `SKILL.md` is cut to its first 500 characters.

342342* `name` may contain lowercase letters (from any alphabet), digits, and hyphens, up to 64 characters. Uppercase letters, spaces, underscores, and other punctuation are rejected.

343343* `displayName` is at most 64 characters and `description` at most 500.

344344* Every `SKILL.md` needs valid YAML frontmatter with a `name` and `description`, neither containing XML tags such as `<example>`. Two skills, or two commands, cannot share a name.

from line 347

347347* File paths must be relative, contain no `..`, and use only letters, digits, spaces, and `_ . - / ( ) ,`.

348348* The request body and the uncompressed archive are each at most 200 MB; a request body over the limit returns `413` (`request_too_large`) rather than `400`. An upload has at most 5,000 files, a path depth of 12, paths of 472 characters, and file or folder names of 255 characters.

349349* ZIP archives must use DEFLATE or STORE compression, and cannot be encrypted or contain symbolic links.

350* An upload that creates a plugin is refused once the marketplace holds 1,000 items. This total includes its plugins and any skills members keep in it. Anthropic can raise this limit and the 5,000-file limit.

350* An upload that creates a plugin returns `400` once the marketplace holds 1,000 plugins. Plugins that this API does not list also count, so the limit can be reached while [List plugins](https://platform.claude.com/docs/en/manage-claude/plugins-api#list-plugins) shows fewer than 1,000 in that marketplace. Anthropic can raise the 5,000-file limit.

351351

352352## Example workflows

353353

from line 363

363363

364364### Roll a plugin out to a pilot group, then to everyone

365365

3661. Look up the pilot group’s ID with `GET /v1/organizations/rbac_groups`. That call needs the `read:rbac_groups` scope, which requires a key created for all linked organizations (see [Groups in User management](https://platform.claude.com/docs/en/manage-claude/user-management#groups)). The next steps need `write:plugins`, which acts only on the organization its key was created in, so in an enterprise with several linked organizations, create this key in the organization that holds the plugin and give it both scopes, or use a second key created there for those steps.

3661. Look up the pilot group’s ID with `GET /v1/organizations/rbac_groups`. That call needs the `read:rbac_groups` scope (see [Groups and roles in User management](https://platform.claude.com/docs/en/manage-claude/user-management#groups-and-roles)). The next steps need `write:plugins`, which acts only on the organization its key was created in, so in an enterprise with several linked organizations, create one key in the organization that holds the plugin and give it both scopes, or use a second key created there for those steps.

367367

3683682. [Give the group its own setting](https://platform.claude.com/docs/en/manage-claude/plugins-api#set-an-installation-setting), for example `auto_install`, with `POST /v1/organizations/plugins/{plugin_id}/installation_settings/{target}`, where `{target}` is the group’s `rbac_group_` ID, while the organization-wide value stays `not_available`. Only the group’s members get the plugin.

369369

from line 374

374374 curl -X POST "https://api.anthropic.com/v1/organizations/plugins/plugin_01Hq3vX8kZcN2mB7pR4tY9wL/installation_settings/organization" \

375375 -H "content-type: application/json" \

376376 -H "x-api-key: $ANTHROPIC_API_KEY" \

377 -H "anthropic-version: 2023-06-01" \

377 -H "anthropic-version: 2026-10-21" \

378378 -H "anthropic-beta: ce-plugins-2026-09-01" \

379379 -d '{"installation_preference": "required"}'

380380 ```

from line 515

515515

516516The plugin object describes a plugin in one of your organization’s marketplaces or in a member’s personal marketplace (the [Quick start](https://platform.claude.com/docs/en/manage-claude/plugins-api#quick-start) response shows a complete one). Its `display_name`, `description`, `manifest_version`, `content_scan`, `components`, and `reach` describe its **served** version, so one list call shows what members are being served.

517517

518| Field | Description |

519| ---------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |

520| `id` | Prefixed `plugin_`. |

521| `name` | From the manifest. Unique within its marketplace, not across the organization. Fixed for an organization-owned plugin; changes if a member renames their own plugin in claude.ai. |

522| `display_name`, `description`, `manifest_version` | The served version’s manifest `displayName`, `description`, and `version`; each is `null` when the manifest declares none. `manifest_version` is normalized for display: one leading `v` or `V` is dropped, so a manifest `version` of `"v1.4.0"` is returned as `"1.4.0"`. It is also `null` for a value that does not look like a version number, such as `"latest"`, and for a plugin version created before claude.ai started recording this field in August 2026. An upload is never refused because of its `version`, and `manifest_version` is not unique. |

523| `served_version_id`, `latest_version_id` | Prefixed `pluginver_`: the version members are served, and the newest version. See [Versions and the served version](https://platform.claude.com/docs/en/manage-claude/plugins-api#versions-and-the-served-version). |

524| `served_version_pinned` | `false` until the plugin is pinned (see [Versions and the served version](https://platform.claude.com/docs/en/manage-claude/plugins-api#versions-and-the-served-version)); `true` from then on. |

525| `owner` | `{"type": "organization"}`, or `{"type": "user", "user_id": "user_..."}` for a member’s personal marketplace. |

526| `marketplace_id` | Prefixed `marketplace_`. |

527| `created_by` | Who created the plugin: `{"type": "user_actor", "user_id": "user_...", "email_address": "..."}` for a person in claude.ai (`email_address` might be `null`), or `{"type": "api_actor", "api_key_id": "apikey_..."}` for an API key. Other actor types may appear. `null` when no creator is recorded, such as for plugins synchronized from Git. |

528| `organization_installation_preference`, `organization_installation_preference_inherited` | Organization-owned: the organization-wide value, and whether it comes from the marketplace’s default (see [Installation settings](https://platform.claude.com/docs/en/manage-claude/plugins-api#installation-settings)). Member-owned: both `null`. |

529| `content_scan` | The served version’s scan result, an object with `status`, `assessment`, and `reason` (described after this table). `null` when it was never scanned. |

530| `components` | The served version’s components, each `{"type", "name", "description"}` with `type` one of `skill`, `mcp_server`, `command`, `agent`, `hook`, or `cli`, listed in that type order and then by name. For an MCP server, `name` is its key in the manifest; for a hook, the event it runs on; for a CLI, the executable’s name. `description` is always `null` for MCP servers, hooks, and CLIs. `null` when not recorded. |

531| `reach` | `contained`, `privileged`, or `remote`. See [Reach](https://platform.claude.com/docs/en/manage-claude/plugins-api#reach). |

532| `updated_at` | Changes when the served version changes, when the plugin becomes pinned, and normally when a new version is stored. A waiting version (see [Versions and the served version](https://platform.claude.com/docs/en/manage-claude/plugins-api#versions-and-the-served-version)) changes it when it becomes the served version, not necessarily when it is stored. It does not change for installation settings, shares, or a change to `content_scan` alone. |

518| Field | Description |

520| `id` | Prefixed `plugin_`. |

521| `name` | From the manifest. Unique within its marketplace, not across the organization. Fixed for an organization-owned plugin; changes if a member renames their own plugin in claude.ai. |

522| `display_name`, `description`, `manifest_version` | The served version’s manifest `displayName`, `description`, and `version`; each is `null` when the manifest declares none. `description` might be a skill’s `description` rather than the manifest’s (described after this table). `manifest_version` is normalized for display: one leading `v` or `V` is dropped, so a manifest `version` of `"v1.4.0"` is returned as `"1.4.0"`. It is also `null` for a value that does not look like a version number, such as `"latest"`, and for a plugin version created before claude.ai started recording this field in August 2026. An upload is never refused because of its `version`, and `manifest_version` is not unique. |

525| `owner` | `{"type": "organization"}`, or `{"type": "user", "user_id": "user_..."}` for a member’s personal marketplace. |

526| `marketplace_id` | Prefixed `marketplace_`. |

529| `content_scan` | The served version’s scan result, an object with `status`, `assessment`, and `reason` (described after this table). `null` when it was never scanned. |

531| `reach` | `contained`, `privileged`, or `remote`. See [Reach](https://platform.claude.com/docs/en/manage-claude/plugins-api#reach). |

533533

534`description` is not always the manifest’s. A `description` that the manifest takes from a top-level `SKILL.md` is cut to its first 500 characters (see [Upload requirements](https://platform.claude.com/docs/en/manage-claude/plugins-api#upload-requirements)). If the manifest’s `description` is the first 500 characters of exactly one distinct skill `description` in `components`, the API returns that skill `description` instead. As a result:

535

536* A `description` that you read might be longer than 500 characters, the limit for an uploaded manifest. An upload whose `plugin.json` sets such a `description` returns `400`.

537* In the [files you download](https://platform.claude.com/docs/en/manage-claude/plugins-api#download-a-versions-files), `.claude-plugin/plugin.json` might have a different `description`, or none.

538

534539The `content_scan` object:

535540

536541| Field | Description |

from line 563

558563 | `other` | Any other concern, including one newer than this list. |

559564</Accordion>

560565

561A `plugin_id` that lacks the `plugin_` prefix returns `400`. A `plugin_id` that carries the prefix but does not resolve, belongs to another organization, or refers to a standalone skill returns `404`.

566A `plugin_id` that lacks the `plugin_` prefix returns `400`. A `plugin_id` that carries the prefix but is not in your organization’s inventory returns `404`.

562567

563568### List plugins

564569

565`GET /v1/organizations/plugins` lists every plugin in your organization, in the organization’s marketplaces and in members’ personal marketplaces, ordered by `created_at` descending. Filter by `owner_type` (`organization` or `user`), `owner_user_id` (an ID prefixed `user_`, which finds a member’s plugins, including after the member leaves the organization), `marketplace_id`, and `created_at[gte]`, `created_at[gt]`, `created_at[lte]`, `created_at[lt]` (RFC 3339 timestamps). Filters combine with AND. A `marketplace_id` or `owner_user_id` that matches nothing in your organization returns an empty page, not an error. The response has the shape shown in [Quick start](https://platform.claude.com/docs/en/manage-claude/plugins-api#quick-start). Requires the `read:plugins` scope.

570`GET /v1/organizations/plugins` lists the plugins in your organization, in the organization’s marketplaces and in members’ personal marketplaces, ordered by `created_at` descending. Filter by `owner_type` (`organization` or `user`), `owner_user_id` (an ID prefixed `user_`, which finds a member’s plugins, including after the member leaves the organization), `marketplace_id`, and `created_at[gte]`, `created_at[gt]`, `created_at[lte]`, `created_at[lt]` (RFC 3339 timestamps). Filters combine with AND. A `marketplace_id` or `owner_user_id` that matches nothing in your organization returns an empty page, not an error. The response has the shape shown in [Quick start](https://platform.claude.com/docs/en/manage-claude/plugins-api#quick-start). Requires the `read:plugins` scope.

566571

567572<CodeGroup>

568573 ```bash cURL

569574 curl "https://api.anthropic.com/v1/organizations/plugins?owner_type=organization&limit=20" \

570575 -H "x-api-key: $ANTHROPIC_API_KEY" \

571 -H "anthropic-version: 2023-06-01" \

576 -H "anthropic-version: 2026-10-21" \

572577 -H "anthropic-beta: ce-plugins-2026-09-01"

573578 ```

574579

from line 684

679684

680685### Create a plugin

681686

682`POST /v1/organizations/plugins` creates an organization-owned plugin and its first version in one call; the version becomes the served version. The body is `multipart/form-data`: `files[]` is either one `.zip` or `.plugin` archive, or one part for each file, where each part’s file name is the file’s path within the plugin (for example `.claude-plugin/plugin.json`). Optional fields are `marketplace_id` (an organization-owned `manual` marketplace, or by default your library marketplace, which is created on first use) and `release_notes` (up to 5,000 characters, shown in claude.ai’s version history and returned on the version). The plugin’s `name`, `display_name`, `description`, and `manifest_version` come from the uploaded manifest, and the upload must meet the [upload requirements](https://platform.claude.com/docs/en/manage-claude/plugins-api#upload-requirements). When content scanning is on, the response’s `content_scan.status` is `processing` and the verdict arrives asynchronously. Returns the plugin. Requires the `write:plugins` scope.

687`POST /v1/organizations/plugins` creates an organization-owned plugin and its first version in one call; the version becomes the served version. The body is `multipart/form-data`: `files[]` is either one `.zip` or `.plugin` archive, or one part for each file, where each part’s file name is the file’s path within the plugin (for example `.claude-plugin/plugin.json`). Optional fields are `marketplace_id` (an organization-owned `manual` marketplace, or by default your library marketplace, which is created on first use) and `release_notes` (up to 5,000 characters, shown in claude.ai’s version history and returned on the version). The plugin’s `name`, `display_name`, `description`, and `manifest_version` come from the uploaded files, and the upload must meet the [upload requirements](https://platform.claude.com/docs/en/manage-claude/plugins-api#upload-requirements). When content scanning is on, the response’s `content_scan.status` is `processing` and the verdict arrives asynchronously. Returns the plugin. Requires the `write:plugins` scope.

683688

684689Upload an archive:

685690

from line 692

687692 ```bash cURL

688693 curl -X POST "https://api.anthropic.com/v1/organizations/plugins" \

689694 -H "x-api-key: $ANTHROPIC_API_KEY" \

690 -H "anthropic-version: 2023-06-01" \

695 -H "anthropic-version: 2026-10-21" \

691696 -H "anthropic-beta: ce-plugins-2026-09-01" \

692697 -F "files[]=@dist/sales-toolkit.zip" \

693698 -F "release_notes=First release"

from line 858

853858 ```bash cURL

854859 curl -X POST "https://api.anthropic.com/v1/organizations/plugins" \

855860 -H "x-api-key: $ANTHROPIC_API_KEY" \

856 -H "anthropic-version: 2023-06-01" \

861 -H "anthropic-version: 2026-10-21" \

857862 -H "anthropic-beta: ce-plugins-2026-09-01" \

858863 -F "files[][email protected]/plugin.json;filename=.claude-plugin/plugin.json" \

859864 -F "files[]=@skills/account-research/SKILL.md;filename=skills/account-research/SKILL.md" \

from line 1048

10431048

10441049Besides a `400` for an upload that breaks the [upload requirements](https://platform.claude.com/docs/en/manage-claude/plugins-api#upload-requirements) (`413` for a request body over 200 MB) and the shared responses (a `403` when `marketplace_id` is a member’s personal marketplace; see [Error responses](https://platform.claude.com/docs/en/manage-claude/plugins-api#error-responses)), a create can fail with:

10451050

1046| Status | Cause | What to do |

1047| -------------------------- | -------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |

1048| 404 | `marketplace_id` is not a marketplace of your organization. | Take the ID from [List marketplaces](https://platform.claude.com/docs/en/manage-claude/plugins-api#list-marketplaces). |

1049| 400 | The marketplace is synchronized from Git, or already holds 1,000 plugins and skills. | Upload to a `manual` marketplace, or change the repository instead. |

1050| 409 `plugin_name_taken` | The name is taken in that marketplace. | Upload a version to `details.plugin_id` only if it is the plugin you meant to update, because someone else might have made it. Otherwise, upload under another name (change the manifest `name`). |

1051| 409 `skill_name_taken` | The plugin is going into the library marketplace and one of its skills has an organization skill’s name. | Rename the skill, or remove the organization skill in claude.ai. |

1052| 409 (no `error_code`) | Another upload with the same name to the same marketplace is still in progress. | Retry shortly. |

1053| 503 `registration_pending` | The plugin was created but its registration did not complete. | Do not resend; upload the same files as a version of `details.plugin_id` (see [Retrying uploads](https://platform.claude.com/docs/en/manage-claude/plugins-api#retrying-uploads)). |

1051| Status | Cause | What to do |

1052| -------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |

1053| 404 | `marketplace_id` is not a marketplace of your organization. | Take the ID from [List marketplaces](https://platform.claude.com/docs/en/manage-claude/plugins-api#list-marketplaces). |

1054| 400 | The marketplace is synchronized from Git, or already holds 1,000 plugins (see [Upload requirements](https://platform.claude.com/docs/en/manage-claude/plugins-api#upload-requirements)). | Upload to another `manual` marketplace, or change the repository instead. |

1055| 409 `plugin_name_taken` | The name is taken in that marketplace. | Upload a version to `details.plugin_id` only if it is the plugin you meant to update, because someone else might have made it. Otherwise, or when `details.plugin_id` is absent, upload under another name (change the manifest `name`). |

1056| 409 `skill_name_taken` | The plugin is going into the library marketplace and one of its skills has an organization skill’s name. | Rename the skill, or remove the organization skill in claude.ai. |

1057| 409 (no `error_code`) | Another upload with the same name to the same marketplace is in progress, or a plugin that this API does not list holds the name. | Retry with backoff. If the `409` persists for more than a few minutes, upload under another name (change the manifest `name`). |

1058| 503 `registration_pending` | The plugin was created but its registration did not complete. | Do not resend; upload the same files as a version of `details.plugin_id` (see [Retrying uploads](https://platform.claude.com/docs/en/manage-claude/plugins-api#retrying-uploads)). |

10541059

10551060### Get a plugin

10561061

from line 1065

10601065 ```bash cURL

10611066 curl "https://api.anthropic.com/v1/organizations/plugins/plugin_01Hq3vX8kZcN2mB7pR4tY9wL" \

10621067 -H "x-api-key: $ANTHROPIC_API_KEY" \

1063 -H "anthropic-version: 2023-06-01" \

1068 -H "anthropic-version: 2026-10-21" \

10641069 -H "anthropic-beta: ce-plugins-2026-09-01"

10651070 ```

10661071

from line 1160

11551160 curl -X POST "https://api.anthropic.com/v1/organizations/plugins/plugin_01Hq3vX8kZcN2mB7pR4tY9wL" \

11561161 -H "content-type: application/json" \

11571162 -H "x-api-key: $ANTHROPIC_API_KEY" \

1158 -H "anthropic-version: 2023-06-01" \

1163 -H "anthropic-version: 2026-10-21" \

11591164 -H "anthropic-beta: ce-plugins-2026-09-01" \

11601165 -d '{"served_version_id": "pluginver_01Jd5sK2nQ8wE4rT6yU1iO3p"}'

11611166 ```

from line 1323

13181323 ```bash cURL

13191324 curl -X DELETE "https://api.anthropic.com/v1/organizations/plugins/plugin_01Hq3vX8kZcN2mB7pR4tY9wL" \

13201325 -H "x-api-key: $ANTHROPIC_API_KEY" \

1321 -H "anthropic-version: 2023-06-01" \

1326 -H "anthropic-version: 2026-10-21" \

13221327 -H "anthropic-beta: ce-plugins-2026-09-01"

13231328 ```

13241329

from line 1423

14181423 ```bash cURL

14191424 curl "https://api.anthropic.com/v1/organizations/plugins/plugin_01Hq3vX8kZcN2mB7pR4tY9wL/versions?limit=50" \

14201425 -H "x-api-key: $ANTHROPIC_API_KEY" \

1421 -H "anthropic-version: 2023-06-01" \

1426 -H "anthropic-version: 2026-10-21" \

14221427 -H "anthropic-beta: ce-plugins-2026-09-01"

14231428 ```

14241429

from line 1544

15391544 ```bash cURL

15401545 curl -X POST "https://api.anthropic.com/v1/organizations/plugins/plugin_01Hq3vX8kZcN2mB7pR4tY9wL/versions" \

15411546 -H "x-api-key: $ANTHROPIC_API_KEY" \

1542 -H "anthropic-version: 2023-06-01" \

1547 -H "anthropic-version: 2026-10-21" \

15431548 -H "anthropic-beta: ce-plugins-2026-09-01" \

15441549 -F "files[]=@dist/sales-toolkit.zip" \

15451550 -F "release_notes=Adds the call-prep command."

from line 1733

17281733 ```bash cURL

17291734 curl "https://api.anthropic.com/v1/organizations/plugins/plugin_01Hq3vX8kZcN2mB7pR4tY9wL/versions/latest" \

17301735 -H "x-api-key: $ANTHROPIC_API_KEY" \

1731 -H "anthropic-version: 2023-06-01" \

1736 -H "anthropic-version: 2026-10-21" \

17321737 -H "anthropic-beta: ce-plugins-2026-09-01"

17331738 ```

17341739

from line 1846

18411846 ```bash cURL

18421847 curl "https://api.anthropic.com/v1/organizations/plugins/plugin_01Hq3vX8kZcN2mB7pR4tY9wL/versions/pluginver_01Km7tL4pR9xF5sU2zV3jP6q/content" \

18431848 -H "x-api-key: $ANTHROPIC_API_KEY" \

1844 -H "anthropic-version: 2023-06-01" \

1849 -H "anthropic-version: 2026-10-21" \

18451850 -H "anthropic-beta: ce-plugins-2026-09-01" \

18461851 -o plugin_01Hq3vX8kZcN2mB7pR4tY9wL_pluginver_01Km7tL4pR9xF5sU2zV3jP6q.zip

18471852 ```

from line 1992

19871992 ```bash cURL

19881993 curl "https://api.anthropic.com/v1/organizations/plugins/plugin_01Hq3vX8kZcN2mB7pR4tY9wL/installation_settings" \

19891994 -H "x-api-key: $ANTHROPIC_API_KEY" \

1990 -H "anthropic-version: 2023-06-01" \

1995 -H "anthropic-version: 2026-10-21" \

19911996 -H "anthropic-beta: ce-plugins-2026-09-01"

19921997 ```

19931998

from line 2103

20982103 curl -X POST "https://api.anthropic.com/v1/organizations/plugins/plugin_01Hq3vX8kZcN2mB7pR4tY9wL/installation_settings/rbac_group_01F3xQqQzXyWvUtSrQpOnMlK" \

20992104 -H "content-type: application/json" \

21002105 -H "x-api-key: $ANTHROPIC_API_KEY" \

2101 -H "anthropic-version: 2023-06-01" \

2106 -H "anthropic-version: 2026-10-21" \

21022107 -H "anthropic-beta: ce-plugins-2026-09-01" \

21032108 -d '{"installation_preference": "available"}'

21042109 ```

from line 2249

22442249 ```bash cURL

22452250 curl -X DELETE "https://api.anthropic.com/v1/organizations/plugins/plugin_01Hq3vX8kZcN2mB7pR4tY9wL/installation_settings/rbac_group_01F3xQqQzXyWvUtSrQpOnMlK" \

22462251 -H "x-api-key: $ANTHROPIC_API_KEY" \

2247 -H "anthropic-version: 2023-06-01" \

2252 -H "anthropic-version: 2026-10-21" \

22482253 -H "anthropic-beta: ce-plugins-2026-09-01"

22492254 ```

22502255

from line 2370

23652370 ```bash cURL

23662371 curl "https://api.anthropic.com/v1/organizations/plugins/plugin_01Mr2wP7sU3aJ8vX5cY6nS9t/shares" \

23672372 -H "x-api-key: $ANTHROPIC_API_KEY" \

2368 -H "anthropic-version: 2023-06-01" \

2373 -H "anthropic-version: 2026-10-21" \

23692374 -H "anthropic-beta: ce-plugins-2026-09-01"

23702375 ```

23712376

from line 2519

25142519 ```bash cURL

25152520 curl "https://api.anthropic.com/v1/organizations/plugin_marketplaces?owner_type=organization" \

25162521 -H "x-api-key: $ANTHROPIC_API_KEY" \

2517 -H "anthropic-version: 2023-06-01" \

2522 -H "anthropic-version: 2026-10-21" \

25182523 -H "anthropic-beta: ce-plugins-2026-09-01"

25192524 ```

25202525

from line 2637

26322637 ```bash cURL

26332638 curl "https://api.anthropic.com/v1/organizations/plugin_marketplaces/marketplace_01Lp8uM5qS1yG6tV3aW4kQ7r" \

26342639 -H "x-api-key: $ANTHROPIC_API_KEY" \

2635 -H "anthropic-version: 2023-06-01" \

2640 -H "anthropic-version: 2026-10-21" \

26362641 -H "anthropic-beta: ce-plugins-2026-09-01"

26372642 ```

26382643

from line 2736

27312736 curl -X POST "https://api.anthropic.com/v1/organizations/plugin_marketplaces/marketplace_01Lp8uM5qS1yG6tV3aW4kQ7r" \

27322737 -H "content-type: application/json" \

27332738 -H "x-api-key: $ANTHROPIC_API_KEY" \

2734 -H "anthropic-version: 2023-06-01" \

2739 -H "anthropic-version: 2026-10-21" \

27352740 -H "anthropic-beta: ce-plugins-2026-09-01" \

27362741 -d '{"default_installation_preference": "available"}'

27372742 ```

from line 2875

28702875 curl -X POST "https://api.anthropic.com/v1/organizations/plugin_marketplaces/validate_repository" \

28712876 -H "content-type: application/json" \

28722877 -H "x-api-key: $ANTHROPIC_API_KEY" \

2873 -H "anthropic-version: 2023-06-01" \

2878 -H "anthropic-version: 2026-10-21" \

28742879 -H "anthropic-beta: ce-plugins-2026-09-01" \

28752880 -d '{"repository_url": "https://github.com/example-org/claude-plugins", "ref": "release-candidate"}'

28762881 ```

from line 3031

30263031 ```bash cURL

30273032 curl -X POST "https://api.anthropic.com/v1/organizations/plugin_marketplaces/validate_archive" \

30283033 -H "x-api-key: $ANTHROPIC_API_KEY" \

3029 -H "anthropic-version: 2023-06-01" \

3034 -H "anthropic-version: 2026-10-21" \

30303035 -H "anthropic-beta: ce-plugins-2026-09-01" \

30313036 -F "[email protected]"

30323037 ```

from line 3159

31543159

31553160## Rate limiting

31563161

3157Read requests (every `GET` endpoint on this page) share a limit of **300 requests per minute** for each organization. Write requests (creating a plugin or version, changing the served version, deleting, setting or removing an installation setting, and updating a marketplace) share a limit of **60 requests per minute** for each organization. A marketplace validation (either endpoint) counts as a read, and validations are additionally limited to 10 a minute for each organization across both endpoints; both limits are checked before the request body is read. These limits are counted across all of your organization’s keys and are separate from your organization’s other Admin API limits. Requests over a limit return **429 Too Many Requests** with a `retry-after` header. Responses include `anthropic-ratelimit-requests-*` headers for the limit that applies (on marketplace validation, its 10-per-minute limit; on a `429`, whichever limit refused the request).

3162Read requests (every `GET` endpoint on this page) share a limit of **300 requests per minute** for each organization. Write requests (creating a plugin or version, changing the served version, deleting, setting or removing an installation setting, and updating a marketplace) share a limit of **60 requests per minute** for each organization. A marketplace validation (either endpoint) counts as a read, and validations are additionally limited to 10 a minute for each organization across both endpoints; both limits are checked before the request body is read. These limits are counted across all of your organization’s keys and are separate from your organization’s other Admin API limits. A read that passes `organization_id` counts against the limit of the organization the key was created in, or of the parent organization if the key has no organization of its own. Requests over a limit return **429 Too Many Requests** with a `retry-after` header. Responses include `anthropic-ratelimit-requests-*` headers for the limit that applies (on marketplace validation, its 10-per-minute limit; on a `429`, whichever limit refused the request).

31583163

31593164An upload, a served-version change, or a validation can also return `429` with `retry-after` when the service briefly has no capacity for another one, and an upload returns `429` when your organization has exceeded its content-scan rate. Handle all of these the same way: wait for `retry-after`, then retry. Separately from these limits, send installation-setting writes for the same plugin one at a time: when several arrive at the same time, some can be answered with `503` and `x-should-retry: true`, and those are safe to send again after a second or two (see [Set an installation setting](https://platform.claude.com/docs/en/manage-claude/plugins-api#set-an-installation-setting)).

31603165

from line 3202

31973202}

31983203```

31993204

3200| `error_code` | Status | Meaning and what to do |

3201| ----------------------------------------------- | ------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |

3202| `plugin_name_taken` | 409 | A plugin with this name already exists in the marketplace. `details.plugin_id` is that plugin, and someone else might have made it. To see who, [get the plugin](https://platform.claude.com/docs/en/manage-claude/plugins-api#get-a-plugin) and read its `created_by`, which is `null` when no creator is recorded. Upload versions to it only if it is the plugin you meant to update. Otherwise, upload under another name. When `plugin_id` is absent, the name is held by a standalone skill: upload under another name, or delete the skill in claude.ai. |

3203| `skill_name_taken` | 409 | The plugin is in the library marketplace and one of its skills has the same name as an organization skill (a skill an administrator uploaded for the whole organization in claude.ai). `details.skill_name` names it. Rename or remove one of them. |

3204| `registration_pending` | 503 | The files were stored, but the plugin’s skills could not yet be made available to members. See [Retrying uploads](https://platform.claude.com/docs/en/manage-claude/plugins-api#retrying-uploads). |

3205| `scan_pending` | 409 | The version’s `content_scan` reads `processing`. Retry once the scan finishes. |

3206| `scan_failed` | 400 | The version’s `content_scan` reads `fail`, `unknown`, or `errored`, so it cannot be served. Choose another version. |

3207| `cmek_key_disabled`, `cmek_key_network_blocked` | 400 | Your organization’s customer-managed encryption key is unavailable. See [Customer-managed encryption keys](https://platform.claude.com/docs/en/manage-claude/plugins-api#customer-managed-encryption-keys). |

3208| `unsupported_charset` | 400 | On an upload or `validate_archive`, the request’s `Content-Type` header names a charset other than UTF-8, ISO-8859-1, or US-ASCII. Send the request with no charset, or with one of these. |

3205| `error_code` | Status | Meaning and what to do |

3206| ----------------------------------------------- | ------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |

3207| `plugin_name_taken` | 409 | The marketplace already holds this name. `details.plugin_id` is the plugin that holds it, and someone else might have made it. To see who, [get the plugin](https://platform.claude.com/docs/en/manage-claude/plugins-api#get-a-plugin) and read its `created_by`, which is `null` when no creator is recorded. Upload versions to it only if it is the plugin you meant to update. Otherwise, or when `plugin_id` is absent, upload under another name. |

3208| `skill_name_taken` | 409 | The plugin is in the library marketplace and one of its skills has the same name as an organization skill (a skill an administrator uploaded for the whole organization in claude.ai). `details.skill_name` names it. Rename or remove one of them. |

3209| `registration_pending` | 503 | The files were stored, but the plugin’s skills could not yet be made available to members. See [Retrying uploads](https://platform.claude.com/docs/en/manage-claude/plugins-api#retrying-uploads). |

3210| `scan_pending` | 409 | The version’s `content_scan` reads `processing`. Retry once the scan finishes. |

3211| `scan_failed` | 400 | The version’s `content_scan` reads `fail`, `unknown`, or `errored`, so it cannot be served. Choose another version. |

3212| `cmek_key_disabled`, `cmek_key_network_blocked` | 400 | Your organization’s customer-managed encryption key is unavailable. See [Customer-managed encryption keys](https://platform.claude.com/docs/en/manage-claude/plugins-api#customer-managed-encryption-keys). |

3213| `unsupported_charset` | 400 | On an upload or `validate_archive`, the request’s `Content-Type` header names a charset other than UTF-8, ISO-8859-1, or US-ASCII. Send the request with no charset, or with one of these. |

32093214

32103215New codes may be added. Treat a code you do not recognize the way you treat its status.

32113216

from line 3243

32383243| `claude_plugin_archive_accessed` | A member-owned plugin’s archive is downloaded. |

32393244| `claude_plugin_security_scan_completed` | A content scan completes. |

32403245

3241The plugin, version, and marketplace IDs in these events are the same IDs this API returns. `plugin_installation_preference_updated` identifies the plugin by its `name` and `marketplace_id` rather than its `id`. In `claude_plugin_security_scan_completed`, `plugin_version` is not a version ID, and no field of a [plugin version](https://platform.claude.com/docs/en/manage-claude/plugins-api#plugin-versions) corresponds to it.

3246The plugin, version, and marketplace IDs in these events are the same IDs this API returns. An event can also name a marketplace that this API does not list, such as a marketplace of plugins that Anthropic publishes. `plugin_installation_preference_updated` identifies the plugin by its `name` and `marketplace_id` rather than its `id`. In `claude_plugin_security_scan_completed`, `plugin_version` is not a version ID, and no field of a [plugin version](https://platform.claude.com/docs/en/manage-claude/plugins-api#plugin-versions) corresponds to it.

32423247

32433248Changing a marketplace’s default records one `marketplace_updated` event and no per-plugin events, even though it changes the value of every plugin that inherits the default. Reads are not recorded, except downloads of a member-owned plugin’s archive. A write that changes nothing records nothing.

32443249

This page’s history 14 edits

4 Nov 2026 +78 −73 · this one
30 Oct 2026 +2 −2
27 Oct 2026 +122 −122
23 Oct 2026 +50 −35
23 Oct 2026 +7 −7
22 Oct 2026 +17 −17

The page’s own history →

Where it came from

The captureapi
Upstream pageplatform.claude.com

Around it

Every changethe ledger
That day4 Nov 2026