Skip to content
codeon
CodeOn Core
API REFERENCE

POST /api/v1/tamper-report

A plugin calls this endpoint when its local build-stamp verification fails. The call is intentionally quiet: the plugin is already in recovery mode, so CodeOn records the signal without creating a retry storm.

Method
POST
Path
/api/v1/tamper-report

Request body

{
  "plugin_id": "balance-sync",
  "domain": "https://store.example.ge",
  "reported_build_id": "1a8f7353-72ce-4f58-89ef-8e834f0dfc4f",
  "license_key": "SMS-7X4A-9KLM-2NQR-PV5Z",
  "plugin_version": "0.3.18"
}
plugin_id
Required. Must match a known CodeOn plugin id.
domain
Required. Normalized before storage.
reported_build_id
Optional. Stored verbatim for forensics.
license_key
Optional. If valid and known, the matching license is flagged.
plugin_version
Optional. Stored with the report.

Response contract

The endpoint returns HTTP 202 with { "ok": true } for valid reports, invalid schemas, unknown plugin IDs, and most internal insert failures. That is deliberate: tamper reporting is a best-effort signal, not a plugin-facing error channel.

Server behavior

  • Normalize and store the domain, source IP, user agent, plugin ID, build ID, and plugin version.
  • Accept reports even when the license key is missing or unknown.
  • If the license key is valid and known, attach the report to that license.
  • Flag the license with a tamper reason so admins see it on installation review screens.
  • Never unblock or re-enable a plugin from this endpoint; recovery happens through license validation and fresh downloads.