Topolo Docs Topolo Platform
Open workspace

Read marketplace application icon

Read the current uploaded icon and stable asset URL for a published application, including unlisted apps, with the same policy for first-party and third-party owners.

Read the current uploaded icon and stable asset URL for a published application, including unlisted apps, with the same policy for first-party and third-party owners.

Action app_topolo_developers.catalog.icons.get · GET /api/store/icons/{appId}. Intended audience: public.

Catalog flags: readOnly=True, requiresConfirmation=False, destructive=False, agentAccess=auto. HTTP method and empty permission fields do not override the actual effects or authority below.

Authority and prerequisites

  • Declared authorization mode=public, requiredPermission=empty; actual source identity/resource checks below remain mandatory.
  • Discover the actual identifier and current intended state within existing authority. Examples grant no access and are not executable probes.

Identifiers

  • Use the real published appId; do not assume a slug is interchangeable with an application ID.

Input

  • appId: type="string"; minLength=1. Required.

The exact native input/output schemas are retained in the hidden paired layer for this version. Top-level undeclared fields are rejected. Nested open records and semantic prerequisites still need source checks.

Effects and important boundaries

  • Reads the uploaded icon of the resolved catalog application, including an unlisted application, under the same owner policy. The handler excludes retired catalog and sunset runtime states; this response does not certify marketplace approval.
  • This specific route is genuinely public in both catalog mode and source handler. That conclusion comes from the route, not from an empty permission string.
  • Uploaded icon identity is available for unlisted applications too. Missing icon, retired catalog state or sunset runtime state returns icon_not_found; the same rule applies to first- and third-party owners.
  • iconUrl and iconAsset.url are the same uploaded source. assetUrl is a stable redirect; optional pngUrl/pngAssetUrl identify its PNG derivative. No icon fallback is manufactured.
  • Conditional ETag revalidation can return 304 with no JSON body. The asset subroute returns 302, and its optional format only supports png. These transport results are not full action JSON success bodies.
  • The read does not validate an application’s code, release, entitlement or access grants.

Refusals, failures and recovery

  • 404 icon_not_found: Publish the application with an uploaded marketplace icon in the intended environment; retired and sunset applications have no active icon.

This action reads the published marketplace icon and changes no state.

Verification

  • Confirm appId matches the requested published application and iconUrl equals iconAsset.url. Fetch assetUrl and confirm it redirects to the current iconUrl. When present, pngAssetUrl must redirect to pngUrl, the PNG derivative of the same uploaded source.
  • Retain actual request/receipt identifiers securely, preserve UNKNOWN effects and reconcile before any retry.

Run a reviewed request

Discover the current action and its resource requirements before running it. Save the approved input as reviewed-input.json; replace synthetic examples with values obtained through the intended authorized workflow. If discovery requires a resource binding, provide its published type and resolved ID separately on both plan and call. Stop if validation fails or the plan is not executable.

topolo actions get app_topolo_developers.catalog.icons.get --json
topolo actions validate app_topolo_developers.catalog.icons.get --data @reviewed-input.json --json
topolo actions plan app_topolo_developers.catalog.icons.get --data @reviewed-input.json --json
topolo actions call app_topolo_developers.catalog.icons.get --data @reviewed-input.json --json

Worked examples

All examples are synthetic and unrun. They cannot authorize access, create human consent, prove media/provider success or establish financial/customer state. Placeholder tokens are unusable. No contact, payment, notification, provisioning or business read was executed.

Icon metadata illustration

SOURCE-AUTHORED SYNTHETIC, UNRUN. Output assessment: PASS_STRUCTURAL_ONLY_UNRUN.

Input:

{
  "appId": "app_topolo_crm"
}

Output illustration or error excerpt:

{
  "appId": "app_topolo_crm",
  "iconUrl": "https://assets.example.test/icon.svg",
  "iconAsset": {
    "url": "https://assets.example.test/icon.svg"
  },
  "assetUrl": "https://developers.example.test/api/store/icons/app_topolo_crm/asset"
}

200 source-authored shape. URLs are illustrative, not downloaded or verified.

Refusal or failure

SOURCE-AUTHORED SYNTHETIC, UNRUN. Source-derived error-code excerpt only; messages/envelope can differ by layer or locale. Not a captured response. Output assessment: ERROR_EXCERPT_NOT_SUCCESS_SCHEMA.

Input:

{
  "appId": "app_topolo_crm"
}

Output illustration or error excerpt:

{
  "error": "icon_not_found"
}

Missing/retired/sunset icon state is not a placeholder icon success.

Invalid input: stop at schema validation

SOURCE-AUTHORED SYNTHETIC, UNRUN. null is a no-response sentinel, not returned JSON null. Output assessment: NOT_APPLICABLE_NO_REQUEST.

Input:

{}

Output illustration or error excerpt:

null

Intentionally invalid input; no request was issued and no HTTP response/status is asserted.

Boundary: conditional revalidation

SOURCE-AUTHORED SYNTHETIC, UNRUN. Output assessment: EMPTY_BODY_TRANSPORT_NOT_JSON.

Input:

{
  "appId": "app_topolo_crm"
}

Output illustration or error excerpt:

null

304 with an empty body when the request’s ETag matches; null here documents no JSON response, not a returned JSON null.

Source and verification limits

Reviewed against 7b89bd3b39092cdc29f87540847bf99a243f0a40 at apps/api/functions/api/store/[[path]].ts and the published action schema on 2026-10-20. Examples are synthetic and unrun. Source review and schema validation do not prove current deployed behavior, provider completion or business delivery. Response excerpts are labelled where incomplete.

Change log

  • 2026-10-20: Prepared the action guide with paired agent schemas, permission and effect boundaries, worked examples, verification and recovery instructions. Independently checked the pinned source; publication and runtime verification remain separate.