APAI Manifest

The APAI Manifest declares a package's identity, version, dependencies, target platforms, declared permissions, security posture, install modes, and rollback strategy. It is the contract between a package publisher and any environment that installs the package.

Every APAI package has exactly one manifest at its repository root or registry entry. The manifest must validate against the JSON Schema at /schemas/apai.manifest.schema.json (lands in Day 2 build).

schema: apai.manifest.v0.1
name: example-package
version: 0.1.0
publisher: example-publisher
summary: One-sentence description of what this package does.
type: workflow
license: proprietary-preview

entrypoints:
  llm_install_card: https://apai.run/packages/example-package/llms.txt
  repo: https://github.com/example-publisher/example-package
  codex_skill: integrations/codex-skill/SKILL.md

supports:
  prompt_install:
    - chatgpt
    - claude
    - gemini
    - grok
  native_install:
    - codex
    - claude_code
    - gemini_cli
    - cursor
    - local_cli
  remote_connector_future:
    - openai_apps_sdk
    - claude_remote_mcp
    - xai_remote_mcp

permissions:
  secrets_required: false
  paid_api_calls: false
  external_send: false
  file_write: optional_transcript_only
  network_access: documented_install_urls_only
  memory_write: false
  spend_limit_required: false

security:
  signature_required: false
  prompt_injection_scan: required
  hidden_unicode_scan: required
  dependency_scan: required
  human_approval_required_for:
    - destructive_actions
    - external_send
    - credential_request
    - production_deploy

rollback:
  strategy: remove_installed_adapter_files
  receipt_required: true

The permissions block is what gets rendered into the Capability Passport. Every key must be present and explicitly set, even when the answer is the empty / default option. Implicit defaults are not permitted - the goal is that a human reading the manifest can see exactly what the package claims it can do, with no inference.

permissions:
  secrets_required: false | true | string-describing-what-secret
  paid_api_calls: false | true | string-describing-which-API
  external_send: false | true | string-describing-where
  file_write: false | true | string-describing-what-files
  network_access: false | true | string-describing-which-endpoints
  memory_write: false | true | string-describing-which-store
  spend_limit_required: false | true

The manifest schema version is independent of the package version. Packages on a given manifest schema version (e.g. v0.1) are guaranteed to validate against that schema version's JSON Schema. Schema versions follow v0.<minor> until v1.0 ratification.