Web Resource Manifest

Schema id: web-resource-manifest@1 Machine-readable schema: web-resource-manifest.schema.json

The canonical description of a Web Resource's metadata (Section 6.15): an application file — JavaScript, CSS, HTML, JSON, XML, text, or an image — stored in the platform database and packaged as a first-class Solution component, so it travels with the solution rather than being fetched from an external host. The file's bytes travel separately (inline in the Solution package); this manifest is the metadata, validated identically whether a resource is created through the Admin Control Center, submitted via a direct API call, generated by an AI assistant, or carried inside a Solution import — the one-validation-path rule (Section 6.7).

Web Resources are deliberately not Object Storage: Object Storage is the separate blob store for large volumes of operational/user files, whereas a Web Resource is a small application file kept in the database and versioned with the solution. A per-resource size cap enforces the boundary.

Shape

Field	Type	Required	Notes
logicalName	string	yes	Publisher-prefixed, path-like (e.g. par_/dashboard/remoteEntry.js). Lower-case; letters, digits, _, ., /, - only. The path segment lets a bundle's many files share one base.
displayName	string	yes	Human-readable name shown in the Web Resources grid.
description	string | null	no	Short description.
type	string	yes	One of JavaScript, Css, Html, Json, Xml, PlainText, Png, Jpeg, Gif, Svg, Ico, Binary. Fixes the served Content-Type and whether the file is text (editable inline) or binary (upload only).
contentHash	string	yes	Lower-case hex SHA-256 of the file bytes. Re-importing identical content is idempotent, and the served response is cacheable as immutable per hash.
sizeBytes	integer	yes	Size of the file bytes (≥ 0).

Where it is validated

• Create — the Application Layer validates the manifest against web-resource-manifest@1, enforces that logicalName starts with the owning publisher's prefix, and rejects content over the size cap, before storing the bytes.
• Solution import — every embedded Web Resource manifest in a Solution package is re-validated against the same schema before the resource is stored in the target environment.

Serving

The platform serves a Web Resource's bytes from its own origin, setting Content-Type from type and returning contentHash as a strong ETag. Serving from 'self' is what lets a Custom App/Control bundle be loaded under a strict CSP without allow-listing an external origin (Section 6.15, "Packaged mode").

Related

• Custom App Manifest — in Packaged mode, a Custom App's build output is stored as Web Resources and its remoteEntryUrl points at the platform-served path.
• Solution Package — how components (including Web Resources) travel between environments.