App JSON Manifest

The manifest describes how an app is embedded into Flowlu: which parts of the interface it adds content to, which data it requests access to, which settings it requires, and which events it subscribes to.

The manifest is a JSON object with exactly six top-level keys:

Manifest fields explained

scopes — access scopes

A list of API areas the app needs access to. Each item is an object with two fields:

• code — the access scope code;
• permission — the level: read (read-only) or full (read and write). Defaults to read.

Permissions are requested from the administrator when the app is installed; the app's API requests are validated against the granted scopes.

Allowed code values: agile, calendar, contactcenter, telephony, crm, crm.accounts, crm.deals, customlists, fin, fin.invoices, finacts, knowledgebase, orgchart, products, st, task, timetracker, users, user.me, workspace.

placements — integration points

Each item describes a single integration point. General structure:

{
  "code": "<placement type>",
  "props": { "target": { "module": "...", "model": "..." } },
  "content": { "...": "what to display (title, icon, iframe)" },
  "action": { "code": "<what happens on click>", "content": { } }
}

• code — the integration point type (required);
• content — what is displayed: id, title (string), icon.src, iframe.src, etc.;
• props.target — for placements bound to an entity (a tab or widget on a record page): the module and model of the entity;
• action — what happens on click.

Allowed code values (placement types):

Allowed action.code values: do.nothing, follow.link (open a link), show.modal--page / show.modal--iframe (modal window), show.sidepanel--page / show.sidepanel--iframe (side panel), show.tab--page / show.tab--iframe (tab). The set of available actions depends on the placement type.

settings and user_settings — settings

An array of settings groups. Each group has a title (name) and options (a list of fields). Each option field has:

• id — the parameter identifier (up to 32 characters);
• code — the field type;
• title — the label;
• attrs — the field attributes (required, placeholder, checked, value, etc., depending on the type).

settings — app-wide settings (for example, an API key for the entire account). user_settings — personal settings for each user.

Allowed field code values: input.text, input.password, input.number, input.checkbox, input.radio, select, textarea, input.time, input.date, input.datetime, input.file, entity.select, custom.

webhooks — outgoing webhooks

An app can subscribe to data events in the account. Each webhook:

{
  "event": {
    "target": { "module": "<module>", "model": "<entity>" },
    "action": "create"
  },
  "url": "https://app.example.com/webhooks/...",
  "user_id": ""
}

• event.target — the module and model of the entity whose changes are tracked;
• event.action — the event type: create, update, delete, any. For invoices (fin.invoices), paid is also available;
• url — the handler URL on the app's side where the platform sends the data;
• user_id — an optional user the webhook is authorized as (can be left empty).

App Manifest Example

As an example, let's take the "Account Verification" app — it enriches CRM account records with reliability data from an external service: it shows a risk indicator on the record, adds a tab with a detailed report and a separate report across all accounts, and re-checks an account when it is created.

App manifest:

{
  "schemaVersion": "alpha",           // Manifest format version (managed by the system)

  "scopes": [                         // Scopes: which API areas the app needs access to
    { "code": "crm", "permission": "read" }   // Read CRM data (accounts)
  ],

  "placements": [                     // Placements in the interface
    {
      "code": "navigation.mainmenu.item",      // Main menu item — the app's section
      "content": {
        "id": "main_menu",                     // Placement identifier within the app
        "title": "Account Verification",       // Menu item label
        "icon": { "src": "https://app.example.com/static/icon.svg" },  // Item icon
        "iframe": { "src": "https://app.example.com/" }     // What opens in the section
      },
      "action": { "code": "do.nothing" }       // On click — open the section itself
    },
    {
      "code": "entity.detail.widget",          // Widget on an entity record page
      "props": {
        "target": { "module": "crm", "model": "account" }  // Which entity record — a CRM account
      },
      "content": {
        "id": "reliability_badge",
        "title": "Reliability",                // Indicator widget title
        "height": 160,                         // Height as % of the area width (10–400)
        "iframe": { "src": "https://app.example.com/widget/reliability" }  // Risk indicator
      },
      "action": { "code": "do.nothing" }
    },
    {
      "code": "entity.detail.tab",             // Tab on an entity record page
      "props": {
        "target": { "module": "crm", "model": "account" }  // Tab on the account record page
      },
      "content": { "title": "Verification" },  // Tab name
      "action": {                              // On click — show the content in the tab
        "code": "show.tab--iframe",
        "content": { "iframe": { "src": "https://app.example.com/tab/report" } }  // Detailed report
      }
    },
    {
      "code": "report",                        // A separate report in the Reports section
      "props": {
        "target": { "group": "crm" }           // The report group to embed into (CRM)
      },
      "content": {
        "id": "risk_report",
        "title": "Account Risks",              // Report name
        "icon": { "src": "https://app.example.com/static/report.svg" }
      },
      "action": {
        "code": "show.tab--iframe",
        "content": { "iframe": { "src": "https://app.example.com/report/risks" } }
      }
    }
  ],

  "settings": [                       // App settings (shared across the account)
    {
      "title": "General settings",    // Settings group name
      "options": [
        {
          "id": "api_key",                     // Parameter identifier
          "code": "input.text",                // Field type — text
          "title": "Verification service API key",
          "attrs": { "required": true, "placeholder": "Enter the key" }  // Field attributes
        },
        {
          "id": "check_level",
          "code": "select",                    // Field type — dropdown
          "title": "Verification level",
          "props": {
            "variants": [                      // Options to choose from (at least 1)
              { "title": "Basic", "attrs": { "value": "basic", "selected": true } },  // Selected by default
              { "title": "Extended", "attrs": { "value": "extended" } }
            ]
          },
          "attrs": { "required": true }        // Required field
        }
      ]
    }
  ],

  "user_settings": [                  // Personal settings for each user
    {
      "title": "Personal settings",
      "options": [
        {
          "id": "show_financials",
          "code": "input.checkbox",            // Field type — checkbox
          "title": "Show financial indicators in the reliability widget",
          "attrs": { "checked": true }         // Enabled by default
        }
      ]
    }
  ],

  "webhooks": [         // Outgoing webhooks: which events the app subscribes to
    {
      "event": {
        "target": { "module": "crm", "model": "account" },  // The entity whose changes are tracked
        "action": "create"                // Event type: create | update | delete | any
      },
      "url": "https://app.example.com/webhooks/account-created",  // Where the platform sends the data (re-check the account)
      "user_id": ""             // User the webhook is authorized as (can be left empty)
    }
  ]
}