Create, validate, preview, and publish a managed Space

Create an OAuth app with a custom Client ID and real redirect URI, put that ID in root space.json, then create a draft Space. Manifest ID and OAuth Client ID must match; the Space resource ID is a separate UUID. Unknown manifest fields fail. version must be a unique semantic version, entry an included .html, and requestedScopes must include profile and may add only agents or economy.

ZIP limits are 20 MiB uploaded, 512 files, 40 MiB decompressed, and 10 MiB per file. It requires root space.json, approved extensions, safe non-symlink paths, and no HTML <base>. The server validates and scans even after arinova space build. declaredApiOrigins allows eight unique bare HTTPS origins and must include the deployment API origin when the SDK calls it.

Bundle upload remains multipart REST, not an Action. After upload, the Agent can list versions, create a signed 15-minute preview, rescan, publish, roll back, or delete an inactive version. Publish, rollback, and deletion use UserConfirm + Strict; the active version cannot be deleted. Publish and rollback rescan, revoke Space tokens, and reconnect players. High risk returns HTTP 202, rejects the version, and leaves it unlisted. A passing rescan restores rejected to draft and closes its safety case. Five versions are retained while protecting active and pending-review versions. Listed-Space Actions are unavailable in public or restricted space_api conversations.

Related actions

arinova.space.list_versions, arinova.space.preview_version, arinova.space.rescan_version, arinova.space.publish_version, arinova.space.rollback_version, arinova.space.delete_version, arinova.space.*

Also known as

publish a Space, Space bundle error, space.json, Space OAuth client ID, rejected Space version, Space preview, arinova space build

---

Machine-readable Markdown · Knowledge index