# extensions.list

`GET /api/public/v1/extensions`

Extensions in this workspace's library with their state (approved, update_pending, unreviewed, rejected, disabled), the version profiles load, a version waiting for review with the permissions it adds, and where each one is assigned.

- Capability: `profile.read`
- Command: no
- MCP tool: `extensions_list`

## Response

`200` with `{ data, correlation_id }`.

| Field | Type | Always present | Description |
|---|---|---|---|
| `data` | array<object> | yes |  |
| `data[].id` | string (uuid) | yes |  |
| `data[].name` | string | yes |  |
| `data[].source` | "store" \| "upload" | yes |  |
| `data[].store_id` | string | no |  |
| `data[].chrome_id` | string | yes | The extension ID every machine loads it under |
| `data[].key_generated` | boolean | yes | Browlix created the key of an uploaded extension without one, so its ID stays the same everywhere |
| `data[].state` | "approved" \| "update_pending" \| "unreviewed" \| "rejected" \| "disabled" | yes |  |
| `data[].revision` | integer | yes | (min -9007199254740991, max 9007199254740991) |
| `data[].active_version` | object | no | The version profiles load |
| `data[].active_version.id` | string (uuid) | yes |  |
| `data[].active_version.version` | string | yes |  |
| `data[].active_version.name` | string | yes |  |
| `data[].active_version.manifest_version` | integer | yes | (min -9007199254740991, max 9007199254740991) |
| `data[].active_version.sha256` | string | yes | SHA-256 of the stored file; machines check it before loading |
| `data[].active_version.size_bytes` | integer | yes | (min -9007199254740991, max 9007199254740991) |
| `data[].active_version.format` | "crx3" \| "zip" | yes |  |
| `data[].active_version.signature` | "verified" \| "unsigned" | yes | verified: every CRX3 proof checked by the server; unsigned: a plain ZIP |
| `data[].active_version.store_signed` | boolean | yes | Also signed by the Chrome Web Store |
| `data[].active_version.permissions` | array<string> | yes |  |
| `data[].active_version.host_permissions` | array<string> | yes | Sites it can read and change (host permissions and content-script matches) |
| `data[].active_version.optional_permissions` | array<string> | yes |  |
| `data[].active_version.license` | string | no | Licence found in the package (SPDX id, or custom); absent when the package has no licence file |
| `data[].active_version.same_version_changed` | boolean | yes | A different file under a version number already in the library |
| `data[].active_version.state` | "unreviewed" \| "approved" \| "rejected" | yes |  |
| `data[].active_version.added_permissions` | array<string> | no | Permissions beyond the version profiles load now (what an approval must acknowledge) |
| `data[].active_version.removed_permissions` | array<string> | no |  |
| `data[].active_version.created_at` | string (date-time) | yes |  |
| `data[].active_version.reviewed_at` | string (date-time) | no |  |
| `data[].pending_version` | object | no | The newest version waiting for review |
| `data[].pending_version.id` | string (uuid) | yes |  |
| `data[].pending_version.version` | string | yes |  |
| `data[].pending_version.name` | string | yes |  |
| `data[].pending_version.manifest_version` | integer | yes | (min -9007199254740991, max 9007199254740991) |
| `data[].pending_version.sha256` | string | yes | SHA-256 of the stored file; machines check it before loading |
| `data[].pending_version.size_bytes` | integer | yes | (min -9007199254740991, max 9007199254740991) |
| `data[].pending_version.format` | "crx3" \| "zip" | yes |  |
| `data[].pending_version.signature` | "verified" \| "unsigned" | yes | verified: every CRX3 proof checked by the server; unsigned: a plain ZIP |
| `data[].pending_version.store_signed` | boolean | yes | Also signed by the Chrome Web Store |
| `data[].pending_version.permissions` | array<string> | yes |  |
| `data[].pending_version.host_permissions` | array<string> | yes | Sites it can read and change (host permissions and content-script matches) |
| `data[].pending_version.optional_permissions` | array<string> | yes |  |
| `data[].pending_version.license` | string | no | Licence found in the package (SPDX id, or custom); absent when the package has no licence file |
| `data[].pending_version.same_version_changed` | boolean | yes | A different file under a version number already in the library |
| `data[].pending_version.state` | "unreviewed" \| "approved" \| "rejected" | yes |  |
| `data[].pending_version.added_permissions` | array<string> | no | Permissions beyond the version profiles load now (what an approval must acknowledge) |
| `data[].pending_version.removed_permissions` | array<string> | no |  |
| `data[].pending_version.created_at` | string (date-time) | yes |  |
| `data[].pending_version.reviewed_at` | string (date-time) | no |  |
| `data[].versions_count` | integer | yes | (min -9007199254740991, max 9007199254740991) |
| `data[].assignments` | array<object> | yes |  |
| `data[].assignments[].id` | string (uuid) | yes |  |
| `data[].assignments[].target_kind` | "workspace" \| "group" \| "profile" | yes |  |
| `data[].assignments[].group_id` | string (uuid) | no |  |
| `data[].assignments[].profile_id` | string (uuid) | no |  |
| `data[].assignments[].target_name` | string | no |  |
| `data[].assignments[].hidden` | boolean | no | The group or profile is outside your group scope: it is not named |
| `data[].assignments[].required` | boolean | yes |  |
| `data[].profiles_reached` | integer | yes | Active profiles at least one assignment reaches (min -9007199254740991, max 9007199254740991) |
| `data[].created_at` | string (date-time) | yes |  |
| `data[].updated_at` | string (date-time) | yes |  |
| `correlation_id` | string (uuid) | yes |  |
| `can_manage` | boolean | no |  |
| `can_approve` | boolean | no |  |

New fields can appear at any time; ignore the ones you do not know.

## Errors

| Code | HTTP | Retryable |
|---|---|---|
| `UNAUTHENTICATED` | 401 | no |
| `FORBIDDEN` | 403 | no |
| `RATE_LIMITED` | 429 | yes |
| `DEPENDENCY_UNAVAILABLE` | 503 | yes |
| `UNKNOWN` | 500 | no |

## Example (curl)

```bash
curl "https://browlix.com/api/public/v1/extensions" \
  -H "Authorization: Bearer $BROWLIX_API_KEY"
```

## Example (TypeScript SDK)

```ts
import { Browlix } from "@browlix/sdk";

const bx = new Browlix({ apiKey: process.env.BROWLIX_API_KEY! });
const reply = await bx.call("extensions.list");
console.log(reply.data);
```

## Example (Python)

```python
import os
import requests

r = requests.get(
    "https://browlix.com/api/public/v1/extensions",
    headers={"Authorization": f"Bearer {os.environ['BROWLIX_API_KEY']}"},
    timeout=60,
)
print(r.status_code, r.json())
```

## Example (MCP)

```json
{
  "method": "tools/call",
  "params": {
    "name": "extensions_list",
    "arguments": {}
  }
}
```