Custom Extensions

Manifests

Use a JSON manifest to define a custom extension’s metadata, source URL, visual style, and permissions before adding it in Organization Settings → Extensions.

Overview

RebelOps accepts extension metadata as a JSON object. In the current app, the manifest is entered in the custom extension form and sent to the organization server as manifest, while role access is sent separately as availability.

The organization server validates manifest.name and availability. If organization encryption is enabled, the app sends manifest_encrypted instead of plain manifest JSON.

Base Manifest Example

JSON
{
  "name": "My Extension",
  "description": "Description of what this extension does",
  "author": "Extension Author",
  "icon": "extension",
  "accent": "blue",
  "permissions": [],
  "source": "https://rebelops-extension.example.com",
  "cover": "https://rebelops-extension.example.com/cover.png"
}

Required Fields

  • name (string, required): extension display name.

In the current client and server validation flow, name is the only required manifest field. Role requirement is not inside the manifest: it is configured as availability in the form.

Optional Fields

  • version: semantic version text.
  • description: short description (UI enforces max 500 chars).
  • author: publisher/author label.
  • icon: icon name mapped by RebelOps icon mapper.
  • accent: accent token used for gradients.
  • source: extension source URL or built-in identifier.
  • cover: optional cover image URL.
  • permissions: permission identifiers.
  • config: custom extension configuration object.

Supported Permission Tokens

  • members
  • projects
  • chat
  • rebelops/tasks

Availability (Role Access)

Availability is sent separately from the manifest and defines the minimum role allowed to use the extension.

  • member
  • chief
  • director
  • owner

Role hierarchy applies: higher roles inherit lower-role access.

Manifest + Availability API Shape

Plain Request
{
  "manifest": {
    "name": "My Extension",
    "source": "https://rebelops-extension.example.com"
  },
  "availability": "director"
}

Encrypted organizations use:

Encrypted Request
{
  "manifest_encrypted": "...encrypted-payload...",
  "availability": "director"
}

Notes on Compatibility

  • Host your extension over HTTPS for runtime loading.
  • Keep unknown fields backward-compatible; current server validation is intentionally permissive beyond required fields.
  • If you include advanced fields (for example AI-related metadata), treat them as extension-owned metadata unless your runtime explicitly uses them.
© 2026 Mironika LLC