Skip to main content
POST
/
v1
/
trpc
/
addons.*
tRPC Addons API
curl --request POST \
  --url 'https://api.glider.fi/v1/trpc/addons.*' \
  --header 'X-API-KEY: <api-key>'
import requests

url = "https://api.glider.fi/v1/trpc/addons.*"

headers = {"X-API-KEY": "<api-key>"}

response = requests.post(url, headers=headers)

print(response.text)
const options = {method: 'POST', headers: {'X-API-KEY': '<api-key>'}};

fetch('https://api.glider.fi/v1/trpc/addons.*', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));
<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.glider.fi/v1/trpc/addons.*",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_HTTPHEADER => [
    "X-API-KEY: <api-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}
package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.glider.fi/v1/trpc/addons.*"

	req, _ := http.NewRequest("POST", url, nil)

	req.Header.Add("X-API-KEY", "<api-key>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}
HttpResponse<String> response = Unirest.post("https://api.glider.fi/v1/trpc/addons.*")
  .header("X-API-KEY", "<api-key>")
  .asString();
require 'uri'
require 'net/http'

url = URI("https://api.glider.fi/v1/trpc/addons.*")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["X-API-KEY"] = '<api-key>'

response = http.request(request)
puts response.read_body
The addons.* namespace is available on the tRPC base endpoint:
  • Base endpoint: POST /v1/trpc
  • Namespace: addons.*
  • Feature gate: addon_platform_installs

​
Procedures

  • addons.issueHostTicket
    • Auth: wallet session
    • Purpose: mint a short-lived signed ticket for browser calls into the addon-host Worker
    • Input: none
    • Response:
      • ticket: opaque ah1.<payload>.<signature> ticket
      • expiresInSeconds: current TTL in seconds (60)
  • addons.listInstalled
    • Auth: wallet session
    • Purpose: list the caller’s active addon installs whose addon definition is still active
    • Input: none
    • Response: active installs with install id, definition id, display metadata, pinned version, manifest hash, granted scopes, and the validated manifest
  • addons.install
    • Auth: wallet session
    • Purpose: create a new addon definition, initial version, active install, and install audit row in one transaction
    • Input:
      • name, 1-80 chars
      • description, 0-400 chars
      • manifest, validated against @repo/addon-contracts; the pinned version is derived from manifest.version (must be x.y.z)
      • grantedScopes, exactly the same set as manifest.scopes
    • Response: install id, definition id, version id, and server-computed sha256:<hex> manifest hash
  • Write procedures (install, uninstall, setEnabled) additionally send a best-effort cache invalidation to the addon-host supervisor when ADDON_HOST_BASE_URL is configured, so /v1/manifests reflects the change immediately (30s TTL is the fallback).
  • addons.uninstall
    • Auth: wallet session
    • Purpose: soft-disable one owned install and append an uninstall audit row
    • Input: installId
    • Response: install id and resulting status
    • Idempotent for already-disabled installs
  • addons.setEnabled
    • Auth: wallet session
    • Purpose: enable or disable one owned install and append an enable/disable audit row
    • Input: installId, enabled
    • Response: install id and resulting status
    • Idempotent when the install is already in the requested state

​
Runtime Notes

  • Disabled addon definitions are a registry kill switch and are omitted from listInstalled.
  • Stored manifests are revalidated at read time. Invalid stored manifests are skipped from the feed instead of failing the whole response.
  • Install rows are never deleted in v1.