One extension contract for apps, plugins and AEUC creator add-ons.

This page is the product contract developers build against now. It clearly separates published requirements from backend pieces that must be implemented before AEUC labels a production SDK stable.

App manifest

PUBLISHED

App ID, version, developer identity, supported AEUC products, required scopes and compatibility range.

OAuth + credentials

CONTRACT

Sandbox credentials, production approval, token rotation, expiry and revocation expectations.

Events + webhooks

CONTRACT

Versioned event payloads, signatures, retries, idempotency and failure handling.

Plugin packaging

CONTRACT

Signed packages, declared permissions, supported host versions and marketplace license checks.

Testing

PUBLISHED

Sandbox data, permission tests, rate-limit tests and failure-mode checks before production review.

Versioning

PUBLISHED

Semantic versions, changelog, compatibility range, rollback path and incident response.

AVAILABLE NOW

Permission Catalog

Developers can review supported scopes and risk levels before submission.

AVAILABLE NOW

Tracked App Review

Real app submissions create review records with declared security, privacy and access requirements.

BEFORE STABLE SDK

Credential + Plugin Runtime

Final OAuth client storage, revocation and signed plugin-host execution still need implementation and verification.