Read platform-global SDK settings

Developing

GET

/ui-extensions/settings

Last modified:2026-08-19 13:49:59

OperationId:readUiExtensionSettings

Which extension zones and platform capabilities are globally disabled, per-resource API read/write deny lists, the approved CDN origin allowlist, the bundle-analysis thresholds and rule policy (reported RESOLVED — every rule with its effective mode), the current ruleset fingerprint, and csp-coverage (whether the portal's deployed CSP script-src actually covers the approved origins). Open to ANY authenticated caller — every Horizon client needs it to gate its extension apps. An unprovisioned instance answers 200 with defaults, not 404.

Request

Authorization

Bearer Token

Provide your bearer token in the

Authorization

header when making requests to protected resources.

Example:

Authorization: Bearer ********************

Responses

🟢200OK

application/json

The settings object. All fields are always present — unset storage falls back to the code default, never to null.

Bodyapplication/json

🟠401Unauthorized

Request Example

Shell

JavaScript

Java

Swift

curl --location 'https://awqacore01.crexendocloud.com/ns-api/v2/ui-extensions/settings' \
--header 'Authorization: Bearer <token>'

Response Example

200 - Example 1

{
    "disabled-zones": [
        "string"
    ],
    "disabled-capabilities": [
        "string"
    ],
    "api-read-deny-resources": [
        "string"
    ],
    "api-write-deny-resources": [
        "string"
    ],
    "approved-cdn-origins": [
        "string"
    ],
    "analysis-settings": {
        "max_entry_bytes": 1000000,
        "max_total_bytes": 8000000,
        "max_chunk_count": 40,
        "max_fetch_seconds": 60,
        "obfuscation_string_array_max": 64,
        "obfuscation_string_array_share_max": 0.05,
        "obfuscation_hex_ratio_max": 0.2,
        "obfuscation_bracket_ratio_max": 0.5,
        "size_delta_flag_ratio": 2
    },
    "analysis-denylist": {
        "bad_packages": [
            "string"
        ],
        "benign": [
            {
                "rule": "document-cookie",
                "path": "node_modules/loglevel/"
            }
        ]
    },
    "analysis-rule-policy": {
        "property1": {
            "mode": "enforce",
            "severity": "reject",
            "buckets": {
                "vendored": "reject",
                "build-injected": "reject"
            }
        },
        "property2": {
            "mode": "enforce",
            "severity": "reject",
            "buckets": {
                "vendored": "reject",
                "build-injected": "reject"
            }
        }
    },
    "analysis-ruleset-fingerprint": "string",
    "csp-coverage": {
        "status": "ok",
        "uncovered": [
            "string"
        ],
        "source": "string"
    }
}

Modified at 2026-08-19 13:49:59

Verification history (read-only)

Update platform-global SDK settings