Plugin permissions
The permissions a marketplace plugin can ask for, and exactly which API paths each one opens to its token.
A marketplace plugin (manifest 2) lists in permissions everything it needs. The administrator sees the list in the
permissions dialog before installing, and approves it by enabling the plugin. An update that asks for more shows the
new ones marked New.
The permissions
| Permission | What it allows |
|---|---|
accounts:read / accounts:write |
the hosting accounts' API paths (below); write also suspends, unsuspends, deletes and changes packages |
domains:read / domains:write |
domains, subdomains, redirects and certificates |
dns:read / dns:write |
DNS zones and records |
mail:read / mail:write |
mailboxes, forwarders and autoresponders |
databases:read |
the databases and their users (read only) |
billing:read |
invoices, payments, orders, products, coupons, the tax report and dunning (read only) |
events:<event> |
its hook runs for that event |
ui:<point> |
a page at that extension point (admin.menu, reseller.menu, client.menu, client.account-card, admin.account-tab) |
net:<host> |
its hooks may connect to that host name (lowercase, with a dot, no address or wildcard; up to 10) |
read allows GET; write also POST, PUT, PATCH and DELETE, and includes read.
What the plugin's token reaches
The plugin's API token answers 403 for every path its permissions don't cover. When several areas match a path, the
longest pattern wins (/accounts/{username}/dns-zones is DNS, not accounts). {u} is any account.
| Area | Paths (after /v1) |
|---|---|
| accounts | /accounts, /accounts/{u} (exactly these two), /accounts/{u}/suspend, /accounts/{u}/unsuspend, /accounts/{u}/package, /accounts/{u}/usage, /packages |
| domains | /domains, /accounts/{u}/domains, /accounts/{u}/subdomains, /accounts/{u}/redirects, /accounts/{u}/ssl-certificates |
| dns | /accounts/{u}/dns-zones |
/mailboxes, /accounts/{u}/email, /accounts/{u}/mailboxes, /accounts/{u}/forwarders, /accounts/{u}/autoresponders |
|
| databases | /databases, /accounts/{u}/databases, /accounts/{u}/mysql, /accounts/{u}/mysql-databases, /accounts/{u}/mysql-users, /accounts/{u}/database-users, /accounts/{u}/postgres, /accounts/{u}/postgres-databases |
| billing | /invoices, /payments, /orders, /products, /coupons, /tax-report, /dunning |
Every path below one of these is included (/accounts/{u}/mailboxes/{address}), except for the two exact
account paths. Nothing else is: not /me, the server, staff, licences, sign-in links (/accounts/{u}/login) or
passwords (/accounts/{u}/password).
Which events bring data
A hook's payload has the event's details only when the plugin may read the event's area; otherwise it has just
id, event, time and server.
| Events | Area needed |
|---|---|
account.*, backup.* |
accounts |
domain.*, ssl.*, site.* |
domains |
email.*, mail.* |
|
database.* |
databases |
coupon.* |
billing |
| any other event | none: always just the four fields |