# Re-authenticate and upload an extension overriding conflicts

Re-authenticates the user and uploads an extension, overriding any existing conflict. Requires user password for verification.

## Endpoints

`POST /bsp/api/v1/bmp/extensions/override`

## Request URL

`https://{server-hostname}:8383/bsp/api/v1/bmp/extensions/override`

## Scope

`BrowserManager.CREATE`

## Header

`Authorization: d92d4xxxxxxxxxxxxx15f52`

## Request Parameters

### Request Headers

| Name | Type | Required | Value | Description |
|---|---|---|---|---|
| Accept | string | Mandatory | `application/json` |  |
| Content-Type | string | Mandatory | `application/json` |  |

### Request Body

`application/json`

**JSON Object**

Request body for re-authenticating and uploading an extension with conflict override.

| Name | Type | Required | Description |
|---|---|---|---|
| userPassword | string | Optional | User password for re-authentication verification |
| app_id | string | Optional | Webstore application identifier |
| type | string | Optional | Extension source type |
| browser_type | string | Optional | Values 1=Chrome, 2=Firefox, 3=IE, 5=Edge, 31=Ulaa, 1024=Chromium |
| xpi_url | string | Optional | URL to Firefox XPI package |
| file_id | integer | Optional | File identifier for inhouse extension packages |
| platform_type | string | Optional | Platform type filter |
| allowed_permissions | array | Optional | List of permission names to allow |

## Sample Request

### Curl

```curl
curl --request POST \
  --url https://appdomain/bsp/api/v1/bmp/extensions/override \
  --header 'Accept: application/json' \
  --header 'Authorization:  d92d4xxxxxxxxxxxxx15f52' \
  --header 'Content-Type: application/json' \
  --data '{"userPassword":"********","platform_type":-1,"browser_type":1,"file_id":0,"type":"web_store","app_id":"abcdefghijklmnop","allowed_permissions":["tabs","storage"],"xpi_url":""}'
```

### Sample Request Body

Override Chrome extension

```json
{
  "userPassword": "********",
  "platform_type": -1,
  "browser_type": 1,
  "file_id": 0,
  "type": "web_store",
  "app_id": "abcdefghijklmnop",
  "allowed_permissions": [
    "tabs",
    "storage"
  ],
  "xpi_url": ""
}
```

## Response Parameters

### HTTP Code 200

**Response Body — `application/json`**

**JSON Object**

Extension profile response after override.

| Name | Type | Description |
|---|---|---|
| extension_id | integer | Unique identifier of the extension profile |
| extension_name | string | Display name of the extension |
| extension_description | string | Description of the extension |
| platform_type | string | Platform type |
| latest_version | string | Latest version number |
| latest_published_version | string | Latest published version number |
| extension_payloads | JSON Array | Extension payload configurations |
| update | boolean | True when the extension was updated by overriding |

### HTTP Code 400

**Response Body — `application/json`**

**JSON Object**

Bad request error when re-authentication fails.

| Name | Type | Description |
|---|---|---|
| error_description | string | Error message indicating invalid username or password |

### HTTP Code 401

**Response Body — `application/json`**

**JSON Object**

| Name | Type | Description |
|---|---|---|
| errorCode | long | Unauthorized error code returned when authentication credentials are missing, expired, or invalid (authentication=required) |
| errorMsg | string | Authentication failure reason |

### HTTP Code 403

**Response Body — `application/json`**

**JSON Object**

| Name | Type | Description |
|---|---|---|
| errorCode | long | Forbidden error code returned when the authenticated user does not have the required uem-roles (e.g., DataEncryption_Admin or DataEncryptionRecoveryKey_Admin) |
| errorMsg | string | Message indicating insufficient privileges to access this resource |

### HTTP Code 429

**Response Body — `application/json`**

**JSON Object**

| Name | Type | Description |
|---|---|---|
| errorCode | long | Rate limit error code returned when the API call threshold (configured via threshold/duration in security XML) is exceeded; client is locked out for lock-period minutes |
| errorMsg | string | Rate limit exceeded message with retry guidance |

### HTTP Code 500

**Response Body — `application/json`**

**JSON Object**

Internal server error during extension operations.

| Name | Type | Description |
|---|---|---|
| error_description | string | Error message describing the server failure |
| error_code | string | Error code for internal server errors |

## Possible Response Codes

- `200` HTTP code
- `400` HTTP code
- `401` HTTP code
- `403` HTTP code
- `429` HTTP code
- `500` HTTP code

## Sample Response: HTTP 200

Extension overridden

```json
{
  "extension_id": 100,
  "platform_type": 1,
  "latest_version": 2,
  "extension_name": "My Extension",
  "latest_published_version": 1,
  "update": true,
  "extension_description": "Extension description",
  "extension_payloads": [
    {
      "payload_type": "64120",
      "extension_payload_id": 101,
      "extension_details": {
        "installsource": "1",
        "browser_type": "1",
        "img_file": "icon16.png",
        "description": "Extension description",
        "extn_type": "web_store",
        "shortname": "My Extension",
        "version": "2.0.0",
        "extensionname": "My Extension",
        "homepageurl": "https://example.com",
        "crx_path": "..\\webapps\\DesktopCentral\\bsp\\client-data\\1\\ManagedExtensions\\3",
        "permissions": [
          "Tabs",
          "Storage"
        ],
        "updateurl": "https://clients2.google.com/service/update2/crx",
        "id": "abcdefghijklmnop",
        "extension_logo_id": "601",
        "allowed_permissions": [
          "tabs",
          "storage"
        ]
      },
      "binary_id": "601"
    }
  ]
}
```

## Sample Response: HTTP 400

Invalid credentials

```json
{
  "error_description": "desktopcentral.common.login.invalid_username_password"
}
```

## Sample Response: HTTP 401

Unauthorized

```json
{
  "errorCode": "UNAUTHORIZED",
  "errorMsg": "You are not authorized to perform this action"
}
```

## Sample Response: HTTP 403

Forbidden

```json
{
  "errorCode": "FORBIDDEN",
  "errorMsg": "You do not have permission to access this resource"
}
```

## Sample Response: HTTP 429

Rate limit exceeded

```json
{
  "errorCode": "RATE_LIMIT_EXCEEDED",
  "errorMsg": "You have exceeded the maximum number of API calls. Please try again later."
}
```

## Sample Response: HTTP 500

Server error

```json
{
  "error_description": "Internal Server error, Please try again in a moment.",
  "error_code": "COM0004"
}
```

## Rate Limit

![](https://www.zohowebstatic.com/sites/zweb/images/people/ico-help.png)

**Duration:** 1 minute | **Threshold:** 60 | **Lock period:** 5 minutes

Duration - Time window for the threshold.  
Threshold - Number of API calls allowed within the specified duration.  
Lock Period - Wait time before consecutive API requests.