Skip to main content
API docs by Redocly

Moodle Marketplace API (1.0.0)

Download OpenAPI specification:Download

Programmatic access to the Moodle Marketplace: browse the plugin catalogue and submit new versions of the plugins you maintain.

Authenticating

Every request needs a bearer token. Create one from your account's security settings, under API tokens.

The raw token is shown once, in a dialog that stops offering it after 60 seconds. It is stored hashed and cannot be retrieved later, only replaced. You may hold up to 10 active tokens; past that, revoke one before creating another.

Send it on every call:

Authorization: Bearer YOUR_TOKEN

To try the endpoints from this page, click Authorize above and paste the raw token — with no Bearer prefix, Swagger adds it for you.

A missing, malformed, expired or revoked token gives 401. Tokens act as you: an endpoint returns exactly what your user account is allowed to see or do.

Responses

Everything is plain JSON (application/json). Collections are bare JSON arrays.

There is no pagination: a collection returns everything you are allowed to see in one response.

Errors

Failures answer with the appropriate status code and an RFC 9457 application/problem+json body. There is no success flag to check in the body — the status code is the answer.

{
  "status": 422,
  "title": "An error occurred",
  "detail": "file: The archive does not contain a valid version.php.",
  "violations": [
    { "propertyPath": "file", "message": "The archive does not contain a valid version.php." }
  ]
}
Status Meaning
400 Bad request The request itself was malformed.
401 Unauthorized No token, or the token is not valid.
403 Forbidden Authenticated, but not allowed to see or change this resource.
404 Not found No such resource.
406 Not acceptable You asked for a media type this API does not serve.
409 Conflict The resource is in a state that does not allow this operation.
422 Unprocessable Content The request was well formed but its contents were rejected. See violations.

violations lists one entry per problem, each with the offending propertyPath and a human-readable message. Show those to the user; do not parse the messages.

Stability

This is version 1 of a young API and it will grow. New fields may be added to any response without notice, so parse defensively and ignore what you do not recognise. Fields will not be removed or change meaning within v1.

Version

A released version of a plugin.

Adds a new version release of a plugin

Submits a new version of a plugin you have permission to maintain, as multipart/form-data.

Give the archive exactly one way: upload it in file, or point at it over HTTPS in fileUrl. Sending both, or neither, is a 422.

The build number, release name, maturity and supported Moodle versions are read out of the archive's version.php — do not send them, they cannot be overridden. The remaining fields are optional and are the only things the archive cannot tell us.

On success you get 201 with the created version. Its status normally reads in_testing rather than uploaded: submitting a version queues it for automated pre-check straight away, so uploaded is never observable. Do not poll for it.

A rejected archive answers 422 with one entry per problem under violations. The same shape covers a bad URL, an unreachable one, and an archive over the size limit.

Authorizations:
bearerAuth
path Parameters
frankenStyle
required
string

Component name of the plugin in its full frankenstyle format.

Request Body schema: multipart/form-data
required

The new VersionCreate resource

file
string or null <binary>

The plugin zip, uploaded directly. Give this or fileUrl, not both.

fileUrl
string or null <uri>

HTTPS URL the Marketplace should download the plugin zip from. Give this or file, not both. Must be https and must resolve to a public address.

https://schema.org/url
releaseNotes
string or null <= 10000 characters

What changed in this release. Optional.

vcsRepositoryUrl
string or null <uri> <= 255 characters

Repository this release was built from. Optional.

https://schema.org/url
vcsBranch
string or null <= 255 characters

Branch this release was built from. Optional.

vcsTag
string or null <= 255 characters

Tag this release was built from. Optional.

Responses

Response samples

Content type
application/json
{
  • "id": 871,
  • "version": "2025082100",
  • "releaseName": "1.4.0",
  • "maturity": "STABLE",
  • "status": "ci_passed",
  • "releaseNotes": "Fixes the grade calculation for group submissions.",
  • "moodleVersions": {
    },
  • "vcsRepositoryUrl": "https://github.com/example/moodle-mod_quiz",
  • "vcsBranch": "main",
  • "vcsTag": "v1.4.0",
  • "createdAt": "2025-08-21T14:03:00+00:00"
}