Skills API
Submit Skill
Submit a skill manifest for marketplace review and publishing.
POST
/
api
/
v1
/
skills
/
submit
Submit Skill
curl --request POST \
--url https://api.example.com/api/v1/skills/submit \
--header 'Content-Type: application/json' \
--data '
{
"manifest": {},
"skill_id": "<string>"
}
'import requests
url = "https://api.example.com/api/v1/skills/submit"
payload = {
"manifest": {},
"skill_id": "<string>"
}
headers = {"Content-Type": "application/json"}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {'Content-Type': 'application/json'},
body: JSON.stringify({manifest: {}, skill_id: '<string>'})
};
fetch('https://api.example.com/api/v1/skills/submit', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.example.com/api/v1/skills/submit",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'manifest' => [
],
'skill_id' => '<string>'
]),
CURLOPT_HTTPHEADER => [
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.example.com/api/v1/skills/submit"
payload := strings.NewReader("{\n \"manifest\": {},\n \"skill_id\": \"<string>\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.example.com/api/v1/skills/submit")
.header("Content-Type", "application/json")
.body("{\n \"manifest\": {},\n \"skill_id\": \"<string>\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.example.com/api/v1/skills/submit")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Content-Type"] = 'application/json'
request.body = "{\n \"manifest\": {},\n \"skill_id\": \"<string>\"\n}"
response = http.request(request)
puts response.read_body{
"submission": {
"id": "<string>",
"status": "<string>",
"reviewTier": "<string>",
"autoApproved": true
},
"review": {
"passed": true,
"tier": "<string>",
"checks": {}
}
}Submit a skill manifest for marketplace review. Automated checks run immediately, and the skill is either auto-approved or queued for manual review based on its risk tier.
Authentication
Requires a Bearer token. See Authentication.Request Body
The full skill manifest object. See Manifest Reference for all fields.
Existing skill UUID if this is a version update (not a new submission).
Request Examples
curl -X POST https://www.hitheo.ai/api/v1/skills/submit \
-H "Authorization: Bearer $THEO_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"manifest": {
"name": "Inventory Check",
"slug": "inventory-check",
"version": "1.0.0",
"description": "Real-time inventory lookup and reorder alerts",
"category": "automation",
"author": { "name": "Acme Corp" },
"systemPromptExtension": "You are an inventory management specialist...",
"tools": [],
"permissions": ["execute:tools"]
}
}'
import { defineSkill } from "@hitheo/sdk";
const manifest = defineSkill({
name: "Inventory Check",
slug: "inventory-check",
version: "1.0.0",
description: "Real-time inventory lookup and reorder alerts",
category: "automation",
author: { name: "Acme Corp" },
systemPromptExtension: "You are an inventory management specialist...",
permissions: ["execute:tools"],
});
const result = await theo.submitSkill(manifest);
console.log(result.status); // "approved" or "pending_review"
console.log(result.reviewTier); // "auto", "staff", or "security"
Response (HTTP 201)
Risk Tiers
| Tier | Description |
|---|---|
auto | Low-risk manifests that pass all automated checks — approved without human review. |
staff | Manifests that introduce tools, knowledge files, or write-scoped permissions — reviewed by the Theo marketplace team. |
security | Manifests that combine external network access with write capability or other sensitive surfaces — reviewed by the security team before publish. |
Example Response (Auto-Approved)
{
"submission": {
"id": "sub_abc123",
"status": "approved",
"reviewTier": "auto",
"autoApproved": true
},
"review": {
"passed": true,
"tier": "auto",
"checks": { "schema": "pass", "injection_scan": "pass", "tool_names": "pass" }
}
}
Errors
| Status | Code | Description |
|---|---|---|
| 422 | review_failed | Automated checks failed — review.checks contains details |
| 429 | rate_limit_exceeded | Submission rate limit exceeded — try again later |
Was this page helpful?
⌘I
Submit Skill
curl --request POST \
--url https://api.example.com/api/v1/skills/submit \
--header 'Content-Type: application/json' \
--data '
{
"manifest": {},
"skill_id": "<string>"
}
'import requests
url = "https://api.example.com/api/v1/skills/submit"
payload = {
"manifest": {},
"skill_id": "<string>"
}
headers = {"Content-Type": "application/json"}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {'Content-Type': 'application/json'},
body: JSON.stringify({manifest: {}, skill_id: '<string>'})
};
fetch('https://api.example.com/api/v1/skills/submit', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.example.com/api/v1/skills/submit",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'manifest' => [
],
'skill_id' => '<string>'
]),
CURLOPT_HTTPHEADER => [
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.example.com/api/v1/skills/submit"
payload := strings.NewReader("{\n \"manifest\": {},\n \"skill_id\": \"<string>\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.example.com/api/v1/skills/submit")
.header("Content-Type", "application/json")
.body("{\n \"manifest\": {},\n \"skill_id\": \"<string>\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.example.com/api/v1/skills/submit")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Content-Type"] = 'application/json'
request.body = "{\n \"manifest\": {},\n \"skill_id\": \"<string>\"\n}"
response = http.request(request)
puts response.read_body{
"submission": {
"id": "<string>",
"status": "<string>",
"reviewTier": "<string>",
"autoApproved": true
},
"review": {
"passed": true,
"tier": "<string>",
"checks": {}
}
}