# Upload and register a new managed extension

Uploads and registers a new managed extension (Chrome, Firefox, or Edge) and creates a distribution profile.

## Endpoint

`POST /bsp/api/v1/bmp/extensions`

## Request Details

### Request URL

```text
https://{server-hostname}:8383/bsp/api/v1/bmp/extensions
```

### Scope

`BrowserManager.CREATE`

### Header

```text
Authorization: d92d4xxxxxxxxxxxxx15f52
```

## Request Parameters

### Request Headers

| Parameter | Type | Required | Value |
|---|---|---|---|
| Accept | string | Mandatory | application/json |
| Content-Type | string | Mandatory | application/json |

### Request Body

`application/json`

**JSON Object**

Request body for uploading and registering a new managed extension.

| Attribute | Type | Required | Description |
|---|---|---|---|
| app_id | string | Optional | Webstore application identifier or Firefox add-on slug |
| type | string | Optional | Extension source type: web_store, Non-webstore, or inhouse |
| browser_type | string | Optional | Values 1=Chrome, 2=Firefox, 3=IE, 5=Edge, 31=Ulaa, 1024=Chromium |
| xpi_url | string | Optional | URL to Firefox XPI package |
| file_id | integer | Optional | File identifier for inhouse extension packages |
| platform_type | string | Optional | Platform type filter. 1=Windows, 2=Mac, -1=All |
| allowed_permissions | array | Optional | List of permission names to allow |

## Sample Request

```curl
curl --request POST \
  --url https://appdomain/bsp/api/v1/bmp/extensions \
  --header 'Accept: application/json' \
  --header 'Authorization:  d92d4xxxxxxxxxxxxx15f52' \
  --header 'Content-Type: application/json' \
  --data '{"platform_type":1,"browser_type":1,"type":"web_store","app_id":"mooikfkahbdckldjjndioackbalphokd"}'
```

## Sample Request Body

### Chrome extension

```json
{
  "platform_type": 1,
  "browser_type": 1,
  "type": "web_store",
  "app_id": "mooikfkahbdckldjjndioackbalphokd"
}
```

### Firefox extension

```json
{
  "platform_type": -1,
  "browser_type": 2,
  "type": "web_store",
  "app_id": "ublock-origin"
}
```

### Edge extension

```json
{
  "platform_type": 1,
  "browser_type": 5,
  "type": "web_store",
  "app_id": "jbkfoedolllekgbhcbcoahefnbanhhlh"
}
```

### In-house (custom packaged) extension uploaded via file

```json
{
  "platform_type": 1,
  "file_id": 78901,
  "browser_type": 1,
  "type": "inhouse",
  "allowed_permissions": [
    "tabs",
    "storage"
  ]
}
```

## Response Parameters

### HTTP Code 200

**Response Body:** `application/json`

**JSON Object**

Extension profile details including payloads.

| Attribute | Type | Description |
|---|---|---|
| extension_id | string | Unique identifier of the extension profile |
| collection_id | string | Collection reference ID |
| platform_type | string | Platform type. 1=Windows, 2=Mac, -1=All |
| latest_version | string | Latest version number |
| is_moved_to_trash | boolean | Whether the extension profile is in the trash |
| scope | string | Profile scope. 0=device scope |
| latest_published_version | string | Latest published version number |
| extension_name | string | Display name of the extension |
| extension_description | string | Description of the extension |
| extension_payloads | JSON Array | Extension payload configurations |

### HTTP Code 401

**Response Body:** `application/json`

| Attribute | Type | Description |
|---|---|---|
| errorCode | long | Unauthorized error code returned when authentication credentials are missing, expired, or invalid (authentication=required) |
| errorMsg | string | Authentication failure reason |

### HTTP Code 403

**Response Body:** `application/json`

| Attribute | Type | Description |
|---|---|---|
| errorCode | long | Forbidden error code returned when the authenticated user does not have the required uem-roles (e.g., DataEncryption_Admin or DataEncryptionRecoveryKey_Admin) |
| errorMsg | string | Message indicating insufficient privileges to access this resource |

### HTTP Code 404

**Response Body:** `application/json`

| Attribute | Type | Description |
|---|---|---|
| errorcode | string | Error code for invalid extension identifiers |
| errormsg | string | Human-readable message prompting the user to enter a valid extension identifier |

### HTTP Code 429

**Response Body:** `application/json`

| Attribute | Type | Description |
|---|---|---|
| errorCode | long | Rate limit error code returned when the API call threshold (configured via threshold/duration in security XML) is exceeded; client is locked out for lock-period minutes |
| errorMsg | string | Rate limit exceeded message with retry guidance |

### HTTP Code 500

**Response Body:** `application/json`

**JSON Object**

Internal server error during extension operations.

| Attribute | Type | Description |
|---|---|---|
| error_description | string | Error message describing the server failure |
| error_code | string | Error code for internal server errors |

## Possible Response Codes

| HTTP Code |
|---|
| 200 |
| 401 |
| 403 |
| 404 |
| 429 |
| 500 |

## Sample Responses

### HTTP 200: Extension added

```json
{
  "extension_id": "606",
  "collection_id": "222",
  "platform_type": "1",
  "latest_version": "1",
  "is_moved_to_trash": false,
  "scope": "0",
  "latest_published_version": "--",
  "extension_name": "Selenium IDE",
  "extension_description": "Selenium Record and Playback tool for ease of getting acquainted with Selenium WebDriver.",
  "extension_payloads": [
    {
      "payload_type": "64120",
      "extension_payload_id": "922",
      "extension_details": {
        "installsource": "1",
        "browser_type": "1",
        "img_file": "icon16.png",
        "description": "Selenium Record and Playback tool for ease of getting acquainted with Selenium WebDriver.",
        "extn_type": "web_store",
        "shortname": "Selenium IDE",
        "version": "3.17.2",
        "extensionname": "Selenium IDE",
        "homepageurl": "https://github.com/SeleniumHQ/selenium-ide",
        "crx_path": "..\\webapps\\DesktopCentral\\bsp\\client-data\\1\\ManagedExtensions\\2",
        "permissions": [
          "Tabs",
          "Active tab",
          "Context menu",
          "Downloads",
          "Web navigation",
          "Storage",
          "Debugger"
        ],
        "updateurl": "https://clients2.google.com/service/update2/crx",
        "id": "mooikfkahbdckldjjndioackbalphokd",
        "extension_logo_id": "602",
        "allowed_permissions": []
      },
      "binary_id": "602"
    }
  ]
}
```

### HTTP 401: Unauthorized

```json
{
  "errorCode": "UNAUTHORIZED",
  "errorMsg": "You are not authorized to perform this action"
}
```

### HTTP 403: Forbidden

```json
{
  "errorCode": "FORBIDDEN",
  "errorMsg": "You do not have permission to access this resource"
}
```

### HTTP 404: Invalid extension ID

```json
{
  "errorcode": "BSP_EXT0001",
  "errormsg": "Enter a valid extension identifier"
}
```

### HTTP 429: Rate limit exceeded

```json
{
  "errorCode": "RATE_LIMIT_EXCEEDED",
  "errorMsg": "You have exceeded the maximum number of API calls. Please try again later."
}
```

### HTTP 500: Server error

```json
{
  "error_description": "Internal Server error, Please try again in a moment.",
  "error_code": "COM0004"
}
```

## Rate Limiting

![](https://www.zohowebstatic.com/sites/zweb/images/people/ico-help.png)

**Duration:** 1 minute | **Threshold:** 60 | **Lock period:** 5 minutes

Duration - Time window for the threshold.  
Threshold - Number of API calls allowed within the specified duration.  
Lock Period - Wait time before consecutive API requests.