Plugin Manifest
The manifest is the full runtime contract between ThreeU and your plugin.
Manifest Overview
The plugin manifest is the single source of truth for how ThreeU interacts with your plugin.
Key separation of concerns:
- config_schema — Merchant-facing settings form
- manifest — Plugin/app/theme runtime contract
- brand_plugins.config — Merchant's configured values
- brand_plugins.credentials — Merchant's encrypted secrets
- brand_plugins.permissions — Approved permissions for that install
- brand_plugins.enabled_actions — Actions enabled for that install
- brand_plugins.webhook_secret — Per-install secret for verification
Full Manifest Example
Complete manifest for a shipping plugin:
plugin-manifest.json
JSON
{
"type": "plugin",
"runtime": "remote_http",
"permissions": ["orders:read", "shipping:write"],
"provider": {
"type": "remote_http",
"base_url": "https://api.fastship.com/threeu",
"auth": {
"type": "hmac_sha256",
"signature_header": "X-ThreeU-Signature",
"timestamp_header": "X-ThreeU-Timestamp"
},
"actions": {
"shipping.get_rates": {
"method": "POST",
"path": "/actions/shipping/get-rates",
"timeout_ms": 10000
},
"shipping.create_shipment": {
"method": "POST",
"path": "/actions/shipping/create-shipment",
"timeout_ms": 15000
}
},
"webhooks": {
"inbound_url_mode": "threeu_generated",
"signature_header": "X-Plugin-Signature",
"brand_header": "X-Brand-ID"
}
},
"admin_blocks": {
"settings": { "component": "SettingsPage" }
}
}Manifest Fields
| Field | Type | Description |
|---|---|---|
type | string | "plugin", "theme", or "app" |
runtime | string | Provider runtime type |
permissions | string[] | Required permissions |
provider.type | string | Communication model |
provider.base_url | string | Your hosted service URL |
provider.auth | object | Authentication config |
provider.actions | object | Action endpoint definitions |
provider.webhooks | object | Webhook configuration |
admin_blocks | object | Admin panel UI blocks |