Marketplace
Connector marketplace
The Attesto Marketplace at https://marketplace.attesto.eu
is the public catalog for validated evidence producers. Public
visitors can browse connector cards. Tenant acquisition, installation,
update, revoke, and artifact download require an authenticated
dashboard tenant session. Publisher signup, publisher profile
management, and connector submission use a separate marketplace-only
developer account. Attesto review and publication are private internal
processes and are not exposed to public visitors or marketplace
developers.
Marketplace model
A marketplace item is a validated connector asset. The catalog stores the asset metadata, current version, manifest hash, artifact hash, validation result, entitlement state, install state, and marketplace evidence events. The marketplace does not run connector code in the browser and does not expose connector secrets.
| Object | Meaning |
|---|---|
asset | A connector listing such as GitHub, GitLab, or S3/R2 object commitments. |
version | A validated connector manifest with manifest and artifact hashes. |
entitlement | The tenant's right to download or install a version. |
install | A tenant-scoped installation record for the selected version. |
evidence event | A canonical marketplace receipt for acquisition, installation, submission, or validation. |
Browse the public catalog
The public catalog exposes only validated public assets. It is safe to browse without a tenant session:
Installed free assets can be updated to the current validated version or revoked by an owner/admin. Revoke deactivates both the entitlement and the tenant install; artifact download fails until the tenant acquires and installs the asset again.
The artifact endpoint returns the connector manifest only after the tenant has an active entitlement:
Marketplace evidence events
Marketplace publisher profile create/update, acquisition, install, install update, entitlement revoke, paid purchase, refund, payout, publisher submission, and validation/review actions write canonical marketplace evidence. The receipt hash is derived from the canonical evidence envelope and payload hash; the receipt record stores the tenant, actor, subject, timestamp, and sanitized payload for tenant audit views. This gives operators a deterministic audit trail for who changed publisher identity and who acquired, installed, updated, reviewed, published, refunded, paid out, or revoked which connector version.
Security boundaries
- Public catalog browsing is unauthenticated and read-only.
- Tenant acquire, install, artifact download, install update, and tenant revoke actions require dashboard tenant auth and CSRF.
- Marketplace asset submission, publisher profile changes, developer-tier checkout, billing portal access, and payout onboarding require marketplace-only developer auth and CSRF.
- Free marketplace developer accounts can submit free assets for private review; paid assets require an active paid developer tier and Stripe Connect readiness.
- Public listing review, publication, and marketplace asset withdrawal are private Attesto processes and are not public marketplace or developer APIs.
- Connector manifests are metadata only; they must not contain secrets or raw customer payloads.
- The frontend only receives public catalog data and non-secret build metadata.
- Production bundles must not include source maps, source files, test fixtures, credentials, or API keys.
- Marketplace evidence supports auditability; it does not certify third-party legal compliance by itself.