--- title: Versions url: https://platform.claude.com/docs/en/api/php/beta/organization/plugins/versions --- # Versions ## Create Plugin Version `$client->beta->organization->plugins->versions->create(string pluginID, list files, ?string releaseNotes, ?list betas): BetaPluginVersion` **POST** `/v1/organizations/plugins/{plugin_id}/versions` Add a version to an organization-owned Plugin by uploading the new version's files; it becomes the version served to members unless the Plugin's served version has been pinned. The upload is the same `multipart/form-data` as creating a Plugin: the version's files (`files`, each part sent as `files[]`) and optional `release_notes`. The uploaded manifest's `name` must equal the Plugin's `name`. Returns the stored version; read the Plugin back to see which version it serves. Only a Plugin in a `manual` marketplace takes uploads; a Plugin synchronized from a repository gets its versions from the repository. When the Plugin is in the organization's library marketplace, a version that adds a skill with the name of an organization skill (a skill an administrator uploaded for the whole organization in claude.ai) is refused with a 409: `error_code` `skill_name_taken`, with that name in `details.skill_name`. A 503 with `error_code` `registration_pending` means the version was stored but is not yet usable; a later version create on the Plugin completes it. For a worked example, see [Create a version](https://platform.claude.com/docs/en/manage-claude/plugins-api?sdk_languages=php#create-a-version) in the Plugins API guide. **Accepted credentials:** an Admin API key with the `write:plugins` scope. Every request must include the beta header `anthropic-beta: ce-plugins-2026-09-01`. A request without it returns `404`, exactly as if the endpoint did not exist. The Plugins API is in beta and is available to Claude Enterprise organizations only. It is not available to Claude Platform (Claude Console) organizations, or to organizations with HIPAA readiness enabled. ### Parameters - `pluginID: string` (path parameter) ID of the Plugin (prefixed `plugin_`). - `files: list` The version's files: one part per file, the part's filename being the file's path within the Plugin (for example `skills/review-pr/SKILL.md`), or a single `.zip` or `.plugin` archive holding them all. On the wire each part is named `files[]`, and a part named plain `files` is not read; with cURL, `-F 'files[]=@SKILL.md;filename=skills/review-pr/SKILL.md'`. The files must include the manifest, `.claude-plugin/plugin.json`. - `releaseNotes?:optional string` Release notes stored with the version and shown in its version history in claude.ai; up to 5,000 characters. - `betas?:optional list` (header parameter) This endpoint is in beta: requests must send `ce-plugins-2026-09-01` in this header. ### Returns - `class BetaPluginVersion` - `"plugin_version" type` Always `plugin_version`. - `string id` The version's ID. - `?list components` What the version contains; null when not enumerated. - `?PluginContentScan contentScan` This version's content scan; null when it has not been scanned. - `\Datetime createdAt` RFC 3339. - `?CreatedBy createdBy` Who uploaded this version; null when not recorded. - `?string description` The manifest's description; null when it declares none. - `?string displayName` The manifest's display name; null when it declares none. - `?string manifestVersion` The manifest's `version`, normalized for display: one leading `v` or `V` is dropped, and the result is returned only if it is 1 to 64 characters, starts with a digit, and uses only ASCII letters, digits, `.`, `+`, and `-`; otherwise `null`. For example, `"v1.4.0"` is returned as `"1.4.0"`, and `"latest"` as `null`. For a synchronized plugin, the `version` of its `marketplace.json` entry can take the place of the manifest's `version`. It is also `null` for a version stored before claude.ai began recording this field (August 2026). - `string pluginID` The Plugin's ID. - `?Reach reach` How far the version reaches: `remote`, `privileged`, `contained`, or `null`, as defined on the Plugin's `reach`. - `?string releaseNotes` As supplied with the upload; null when none were supplied. ### Example ```php beta->organization->plugins->versions->create( 'plugin_id', files: [ FileParam::fromString('Example data', filename: uniqid('file-upload-', true)), ], releaseNotes: 'release_notes', betas: [AnthropicBeta::MESSAGE_BATCHES_2024_09_24], ); var_dump($betaPluginVersion); ``` #### Response (200) ```json { "id": "pluginver_01KaZmQpRsTuVwXyZ2b4c6d8", "components": [ { "description": "description", "name": "review-pr", "type": "skill" } ], "content_scan": { "assessment": "warn", "reason": "credential-exposure", "status": "completed" }, "created_at": "2026-03-14T09:26:53.589793Z", "created_by": { "email_address": "user@example.com", "type": "user_actor", "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q" }, "description": "Reviews pull requests against your team's conventions.", "display_name": "Code Review Helper", "manifest_version": "1.2.0", "plugin_id": "plugin_01JyHfbRkZvD1gW7oTqXc3Ne", "reach": "contained", "release_notes": "Adds a review checklist for database migrations.", "type": "plugin_version" } ``` ## List Plugin Versions `$client->beta->organization->plugins->versions->list(string pluginID, ?int limit, ?string organizationID, ?string page, ?list betas): PageCursor` **GET** `/v1/organizations/plugins/{plugin_id}/versions` List a Plugin's versions, newest first. The first item of the first page is the version the Plugin's `latest_version_id` refers to. **Accepted credentials:** an Admin API key with the `read:plugins` or `read:org_audit` scope, or a Compliance Access Key with the `read:compliance_org_data` scope. Every request must include the beta header `anthropic-beta: ce-plugins-2026-09-01`. A request without it returns `404`, exactly as if the endpoint did not exist. The Plugins API is in beta and is available to Claude Enterprise organizations only. It is not available to Claude Platform (Claude Console) organizations, or to organizations with HIPAA readiness enabled. ### Parameters - `pluginID: string` (path parameter) ID of the Plugin (prefixed `plugin_`). - `limit?:optional int` (query parameter) Number of items to return per page. Defaults to `20`. Ranges from `1` to `1000`. default: 20 - `organizationID?:optional string` (query parameter) For a `read:org_audit` or `read:compliance_org_data` key created for all of a parent organization's linked organizations: a child organization of that parent to read instead of the organization the key was created in, given as the organization's UUID or its `org_`-prefixed ID. A value that is neither returns a 400; an organization that is not a child of the key's parent, or where the Plugins API is not available, returns a 404. Any other key may pass only its own organization's ID here; another organization returns a 404. - `page?:optional string` (query parameter) Optionally set to the `next_page` token from the previous response. - `betas?:optional list` (header parameter) This endpoint is in beta: requests must send `ce-plugins-2026-09-01` in this header. ### Returns - `class BetaPluginVersion` - `"plugin_version" type` Always `plugin_version`. - `string id` The version's ID. - `?list components` What the version contains; null when not enumerated. - `?PluginContentScan contentScan` This version's content scan; null when it has not been scanned. - `\Datetime createdAt` RFC 3339. - `?CreatedBy createdBy` Who uploaded this version; null when not recorded. - `?string description` The manifest's description; null when it declares none. - `?string displayName` The manifest's display name; null when it declares none. - `?string manifestVersion` The manifest's `version`, normalized for display: one leading `v` or `V` is dropped, and the result is returned only if it is 1 to 64 characters, starts with a digit, and uses only ASCII letters, digits, `.`, `+`, and `-`; otherwise `null`. For example, `"v1.4.0"` is returned as `"1.4.0"`, and `"latest"` as `null`. For a synchronized plugin, the `version` of its `marketplace.json` entry can take the place of the manifest's `version`. It is also `null` for a version stored before claude.ai began recording this field (August 2026). - `string pluginID` The Plugin's ID. - `?Reach reach` How far the version reaches: `remote`, `privileged`, `contained`, or `null`, as defined on the Plugin's `reach`. - `?string releaseNotes` As supplied with the upload; null when none were supplied. ### Example ```php beta->organization->plugins->versions->list( 'plugin_id', limit: 1, organizationID: 'organization_id', page: 'page', betas: [AnthropicBeta::MESSAGE_BATCHES_2024_09_24], ); var_dump($page); ``` #### Response (200) ```json { "data": [ { "id": "pluginver_01KaZmQpRsTuVwXyZ2b4c6d8", "components": [ { "description": "description", "name": "review-pr", "type": "skill" } ], "content_scan": { "assessment": "warn", "reason": "credential-exposure", "status": "completed" }, "created_at": "2026-03-14T09:26:53.589793Z", "created_by": { "email_address": "user@example.com", "type": "user_actor", "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q" }, "description": "Reviews pull requests against your team's conventions.", "display_name": "Code Review Helper", "manifest_version": "1.2.0", "plugin_id": "plugin_01JyHfbRkZvD1gW7oTqXc3Ne", "reach": "contained", "release_notes": "Adds a review checklist for database migrations.", "type": "plugin_version" } ], "next_page": "page_MjAyNi0wOS0xNlQxNDowNTowOVo" } ``` ## Get Plugin Version `$client->beta->organization->plugins->versions->retrieve(string version, string pluginID, ?string organizationID, ?list betas): BetaPluginVersion` **GET** `/v1/organizations/plugins/{plugin_id}/versions/{version}` Retrieve one version of a Plugin by its ID, or the Plugin's newest version. **Accepted credentials:** an Admin API key with the `read:plugins` or `read:org_audit` scope, or a Compliance Access Key with the `read:compliance_org_data` scope. Every request must include the beta header `anthropic-beta: ce-plugins-2026-09-01`. A request without it returns `404`, exactly as if the endpoint did not exist. The Plugins API is in beta and is available to Claude Enterprise organizations only. It is not available to Claude Platform (Claude Console) organizations, or to organizations with HIPAA readiness enabled. ### Parameters - `pluginID: string` (path parameter) ID of the Plugin (prefixed `plugin_`). - `version: string` (path parameter) ID of the Plugin Version (prefixed `pluginver_`), or `latest` for the newest one. - `organizationID?:optional string` (query parameter) For a `read:org_audit` or `read:compliance_org_data` key created for all of a parent organization's linked organizations: a child organization of that parent to read instead of the organization the key was created in, given as the organization's UUID or its `org_`-prefixed ID. A value that is neither returns a 400; an organization that is not a child of the key's parent, or where the Plugins API is not available, returns a 404. Any other key may pass only its own organization's ID here; another organization returns a 404. - `betas?:optional list` (header parameter) This endpoint is in beta: requests must send `ce-plugins-2026-09-01` in this header. ### Returns - `class BetaPluginVersion` - `"plugin_version" type` Always `plugin_version`. - `string id` The version's ID. - `?list components` What the version contains; null when not enumerated. - `?PluginContentScan contentScan` This version's content scan; null when it has not been scanned. - `\Datetime createdAt` RFC 3339. - `?CreatedBy createdBy` Who uploaded this version; null when not recorded. - `?string description` The manifest's description; null when it declares none. - `?string displayName` The manifest's display name; null when it declares none. - `?string manifestVersion` The manifest's `version`, normalized for display: one leading `v` or `V` is dropped, and the result is returned only if it is 1 to 64 characters, starts with a digit, and uses only ASCII letters, digits, `.`, `+`, and `-`; otherwise `null`. For example, `"v1.4.0"` is returned as `"1.4.0"`, and `"latest"` as `null`. For a synchronized plugin, the `version` of its `marketplace.json` entry can take the place of the manifest's `version`. It is also `null` for a version stored before claude.ai began recording this field (August 2026). - `string pluginID` The Plugin's ID. - `?Reach reach` How far the version reaches: `remote`, `privileged`, `contained`, or `null`, as defined on the Plugin's `reach`. - `?string releaseNotes` As supplied with the upload; null when none were supplied. ### Example ```php beta->organization->plugins->versions->retrieve( 'version', pluginID: 'plugin_id', organizationID: 'organization_id', betas: [AnthropicBeta::MESSAGE_BATCHES_2024_09_24], ); var_dump($betaPluginVersion); ``` #### Response (200) ```json { "id": "pluginver_01KaZmQpRsTuVwXyZ2b4c6d8", "components": [ { "description": "description", "name": "review-pr", "type": "skill" } ], "content_scan": { "assessment": "warn", "reason": "credential-exposure", "status": "completed" }, "created_at": "2026-03-14T09:26:53.589793Z", "created_by": { "email_address": "user@example.com", "type": "user_actor", "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q" }, "description": "Reviews pull requests against your team's conventions.", "display_name": "Code Review Helper", "manifest_version": "1.2.0", "plugin_id": "plugin_01JyHfbRkZvD1gW7oTqXc3Ne", "reach": "contained", "release_notes": "Adds a review checklist for database migrations.", "type": "plugin_version" } ``` ## Download Plugin Version Archive `$client->beta->organization->plugins->versions->download(string version, string pluginID, ?string organizationID, ?list betas): download` **GET** `/v1/organizations/plugins/{plugin_id}/versions/{version}/content` Download one version's `.zip` archive, exactly as stored. Each download of a Plugin from a member's personal plugin marketplace is recorded on the Compliance API activity feed. The response body is the archive (`Content-Type: application/zip`), sent as an attachment whose filename is derived from the Plugin's name; name saved files from the IDs in the request path, since that filename is not unique. **Accepted credentials:** an Admin API key with the `read:plugins` or `read:org_audit` scope, or a Compliance Access Key with the `read:compliance_org_data` scope. Every read scope above (`read:plugins`, `read:org_audit`, and `read:compliance_org_data`) can download the files of plugins in members' personal marketplaces, including files that claude.ai's admin settings do not show, and a `read:org_audit` or `read:compliance_org_data` key created for all of your parent organization's linked organizations can do this in any organization under it that has access to this API, by passing `organization_id`. Each such download records a `claude_plugin_archive_accessed` event on the Compliance API activity feed, identifying the key, the plugin, the version, and the member. Downloads of organization-owned plugins are not recorded. Every request must include the beta header `anthropic-beta: ce-plugins-2026-09-01`. A request without it returns `404`, exactly as if the endpoint did not exist. The Plugins API is in beta and is available to Claude Enterprise organizations only. It is not available to Claude Platform (Claude Console) organizations, or to organizations with HIPAA readiness enabled. ### Parameters - `pluginID: string` (path parameter) ID of the Plugin (prefixed `plugin_`). - `version: string` (path parameter) ID of the Plugin Version (prefixed `pluginver_`). `latest` is not accepted here. - `organizationID?:optional string` (query parameter) For a `read:org_audit` or `read:compliance_org_data` key created for all of a parent organization's linked organizations: a child organization of that parent to read instead of the organization the key was created in, given as the organization's UUID or its `org_`-prefixed ID. A value that is neither returns a 400; an organization that is not a child of the key's parent, or where the Plugins API is not available, returns a 404. Any other key may pass only its own organization's ID here; another organization returns a 404. - `betas?:optional list` (header parameter) This endpoint is in beta: requests must send `ce-plugins-2026-09-01` in this header. ### Returns - `mixed` ### Example ```php beta->organization->plugins->versions->download( 'version', pluginID: 'plugin_id', organizationID: 'organization_id', betas: [AnthropicBeta::MESSAGE_BATCHES_2024_09_24], ); var_dump($response); ``` ## Domain types ### Beta Plugin Version - `class BetaPluginVersion` - `"plugin_version" type` Always `plugin_version`. - `string id` The version's ID. - `?list components` What the version contains; null when not enumerated. - `?PluginContentScan contentScan` This version's content scan; null when it has not been scanned. - `\Datetime createdAt` RFC 3339. - `?CreatedBy createdBy` Who uploaded this version; null when not recorded. - `?string description` The manifest's description; null when it declares none. - `?string displayName` The manifest's display name; null when it declares none. - `?string manifestVersion` The manifest's `version`, normalized for display: one leading `v` or `V` is dropped, and the result is returned only if it is 1 to 64 characters, starts with a digit, and uses only ASCII letters, digits, `.`, `+`, and `-`; otherwise `null`. For example, `"v1.4.0"` is returned as `"1.4.0"`, and `"latest"` as `null`. For a synchronized plugin, the `version` of its `marketplace.json` entry can take the place of the manifest's `version`. It is also `null` for a version stored before claude.ai began recording this field (August 2026). - `string pluginID` The Plugin's ID. - `?Reach reach` How far the version reaches: `remote`, `privileged`, `contained`, or `null`, as defined on the Plugin's `reach`. - `?string releaseNotes` As supplied with the upload; null when none were supplied.