# Install a plugin

> Install a plugin by ref (name@marketplace) from a marketplace the workspace reads, at the commit its listing names, which it stays pinned to.

<div class="g1t-endpoint"><span class="g1t-method" data-method="post">POST</span><code>/workspaces/{workspace}/customize/plugins</code></div>

Its skills and commands join the workspace's library as `plugin:skill`, its subagents become templates to hire from, and the remote MCP servers of its `.mcp.json` become connectors, unconnected until an owner signs in or gives a key; its hooks, LSP servers, output styles and binaries reach Claude Code on runners and never g1t's own agents. A plugin g1t cannot fetch (npm, a command, a git host g1t does not read) is refused with `422`. At most 100 a workspace. Owners only. Recorded in the audit log.

Its skill is now `release-notes:release-notes` in the library, `release-writer` is a template under Agents, and the `linear` server is a connector waiting for an owner to sign in (`list_connectors` shows it as `needs_sign_in`, with `from.kind` `plugin`). A plugin already installed answers `409`; one whose source g1t cannot fetch answers `422`.

- **Authentication:** Required. Send an [access token](/reference/api/#authentication) as `Authorization: Bearer`.
- **MCP tool:** [`customize`](/reference/mcp/#customize) with `action` `install_plugin`, and the same inputs
- **Scope:** An access token needs [`workspace:admin`](/guides/authentication/#scopes).

## Path parameters

| Name | Type | Required | Description |
| --- | --- | --- | --- |
| `workspace` | string | Yes | The workspace's slug. |

## Body parameters

Send a JSON object. Names are `snake_case`, as in responses; the `camelCase` spelling is accepted too.

| Name | Type | Required | Description |
| --- | --- | --- | --- |
| `ref` | string | Yes | The plugin as name@marketplace, such as commit-commands@claude-plugins-official. |

## Example request

```sh
curl -X POST https://api.g1t.sh/workspaces/flagon-io/customize/plugins \
  -H "Authorization: Bearer $G1T_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "ref": "release-notes@flagon-tools"
  }'
```

## Example response

A successful request answers `200` with:

```json
{
  "id": "plg_01kq9g3j5l7n9q1s3u5w7y9a1c",
  "ref": "release-notes@flagon-tools",
  "name": "release-notes",
  "marketplace": "flagon-tools",
  "display_name": "Release notes",
  "description": "Writes release notes from merged pull requests.",
  "version": "0.3.1",
  "sha": "4f6a8e1b3d5f7a9c1e3b5d7f90a1c3e5b7d9f1a3",
  "fetch": {
    "kind": "g1t",
    "repo": "flagon-io/plugins",
    "ref": null,
    "path": "plugins/release-notes"
  },
  "components": {
    "skills": [
      {
        "name": "release-notes",
        "description": "Write release notes from the pull requests merged since the last tag.",
        "path": "skills/release-notes/SKILL.md"
      }
    ],
    "agents": [
      {
        "name": "release-writer",
        "description": "Drafts a release's notes and asks a maintainer to check them.",
        "path": "agents/release-writer.md"
      }
    ],
    "commands": [],
    "mcp_servers": [
      {
        "name": "linear",
        "type": "http",
        "url": "https://mcp.linear.app/mcp",
        "remote": true
      }
    ],
    "hooks": false,
    "lsp": false,
    "bin": false,
    "output_styles": false
  },
  "problems": [],
  "enabled": true,
  "installed_by": "syntaqx",
  "installed_at": "2026-10-11T14:20:31.904Z",
  "update": null
}
```

## Errors

A failed request answers with one of these statuses and a body like `{"error": {"code": "not_found", "message": "Repository not found."}}`. See [errors](/reference/api/#errors).

| Status | Code | When |
| --- | --- | --- |
| 401 | `unauthenticated` | A token is required, or the one sent is not valid. |
| 403 | `forbidden` | The token is valid but not allowed to do this, such as a member-only change or an agent token outside its repository. |
| 404 | `not_found` | It does not exist, or you cannot see it. |
| 409 | `conflict` | The request conflicts with the current state. |
| 422 | `invalid` | The input is not valid. `message` says which field and why. |