Plugins register skill bundles with the gateway so the MoE engine can discover them. A client syncs its local workspace and global plugin directories up to the gateway; the gateway keeps the registry.

Base URL: https://api.misar.io/coder. All three endpoints authenticate with Authorization: Bearer <API_KEY>.

List plugins

GET/plugins

Registered plugins, newest first, capped at 200.

Query parameters

statusstringquery

Filter by plugin status. An unrecognised value simply yields an empty list rather than an error.

Response fields

pluginsobject[]

Plugin manifests — see the field list below.

countnumber

Number of plugins returned.

Request

curl https://api.misar.io/coder/plugins \
  -H "Authorization: Bearer $MISARCODER_API_KEY"

200 — OK

{
  "plugins": [
    {
      "id": "pl_01J8…",
      "plugin_id": "misar.workspace.deploy-helper",
      "name": "deploy-helper",
      "version": "1.2.0",
      "description": "Deployment skills for the acme stack",
      "type": "skill",
      "capabilities": ["skills:4"],
      "endpoints": [],
      "auth": "none",
      "signature": "",
      "status": "active",
      "security_score": 0.92,
      "registered_at": "2026-07-30T10:11:00.000Z",
      "updated_at": "2026-08-01T08:02:14.000Z",
      "invocations": 41,
      "successes": 40,
      "total_latency": 12.482,
      "meta": { "source": "workspace", "skill_count": 4 }
    }
  ],
  "count": 1
}

Manifest fields

idstring

Internal registry id, prefixed pl_. Use this to delete.

plugin_idstring

Semantic id, formed as misar.<source>.<name>.

namestring

Plugin name.

versionstring

Plugin version. Deduplication is on plugin_id plus version.

descriptionstring

Truncated to 300 characters.

typestring

Plugin type. Synced plugins are registered as skill.

capabilitiesstring[]

Declared capabilities, e.g. skills:4.

statusstring

Lifecycle state — active or disabled.

security_scorenumber

Rounded to three decimal places.

invocationsnumber

Times the plugin was called.

successesnumber

Successful invocations.

total_latencynumber

Cumulative latency in seconds, rounded to three decimal places.

metaobject

Free-form metadata, e.g. { source, skill_count }.

Sync plugins

POST/plugins/sync

Registers a batch of plugins discovered on the client and returns the full registry afterwards.

Request body

pluginsobject[]bodyrequired

Plugin entries to register.

plugins[].namestringbodyrequired

Plugin name.

plugins[].versionstringbodydefault: 0.0.0

Plugin version.

plugins[].descriptionstringbody

Short description.

plugins[].sourcestringbodydefault: workspace

workspace or global. Becomes part of the semantic plugin_id.

plugins[].skillCountnumberbodydefault: 0

How many skills the plugin bundles.

Response fields

syncednumber

How many entries registered successfully.

pluginsobject[]

The registry after the sync, capped at 200.

countnumber

Length of plugins.

Request

curl -X POST https://api.misar.io/coder/plugins/sync \
  -H "Authorization: Bearer $MISARCODER_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "plugins": [
      {
        "name": "deploy-helper",
        "version": "1.2.0",
        "description": "Deployment skills for the acme stack",
        "source": "workspace",
        "skillCount": 4
      }
    ]
  }'

200 — Synced

{ "synced": 1, "plugins": [], "count": 0 }

Sync is idempotent per version

Re-syncing the same plugin_id and version returns the existing registration rather than creating a duplicate. Bump the version to register a change.

Disable a plugin

DELETE/plugins/{plugin_id}

This disables, it does not delete

The plugin's status is set to disabled and the record is retained. A removed: true response means "the plugin is now disabled", and disabling an already-disabled plugin also returns true.

Path parameters

plugin_idstringpathrequired

Either the internal pl_… id or the semantic misar.<source>.<name> id. Slashes are permitted.

Response fields

removedboolean

true when the plugin is disabled.

idstring

Echo of the id you supplied, not the internal one.

Request

curl -X DELETE https://api.misar.io/coder/plugins/misar.workspace.deploy-helper \
  -H "Authorization: Bearer $MISARCODER_API_KEY"

200 — Disabled

{ "removed": true, "id": "misar.workspace.deploy-helper" }

Status codes

Code	Meaning
`200`	Listed, synced, or disabled
`401`	`Missing authorization` or `Invalid API key`
`404`	`Plugin '<id>' not found`
`422`	Body failed validation

Limits

Limit	Value
Plugins returned by list and sync	200
Entries per sync request	Unbounded
Description length stored	300 characters

Plugins

List plugins

Manifest fields

Sync plugins

Disable a plugin

Status codes

Limits

On this page