# Publish to the marketplace

> How to get a public app listed in the Kustomer App Directory, including listing assets, review requirements, the data and security questionnaire, timelines, and how updates are reviewed.

Source: https://developer.kustomer.com/docs/apps/marketplace

Public apps appear in every org's **App Directory**. You don't register them yourself: you build and test a private app, then submit its definition, and Kustomer publishes the public version after review.

```mermaid
flowchart LR
  A[Build as a private app] --> B[Test in a sandbox org]
  B --> C[Submit the definition and listing]
  C --> D[Kustomer review<br/>4 to 6 weeks]
  D -->|changes requested| B
  D -->|approved| E[Published in the App Directory]
```

## Build it private first

Develop the whole app as `"visibility": "private"` in a sandbox org. When you submit, Kustomer registers it as public under your plain app name, so write the definition with short names and no org IDs. See [Names are namespaced](https://developer.kustomer.com/docs/apps/register-and-install#names-are-namespaced).

Your submission is a **single JSON file**. If you split the definition across files, ship the built output.

## Listing assets

| Asset          | Requirements                                                                                                                   |
| -------------- | ------------------------------------------------------------------------------------------------------------------------------ |
| Logo           | PNG, 1200 × 1200 px. Corners are rounded for you, so don't round them yourself.                                                |
| Screenshots    | `.jpg`. Show the app working in Kustomer: KViews, widgets, the settings page, workflow actions in the builder.                 |
| `title`        | The product name admins will search for                                                                                        |
| `description`  | What it does, and what data goes to third parties: what is sent, when, and why. Include subscription or pricing requirements.  |
| `appDetails`   | Your company (`appDeveloper`) and, if different, the platform you integrate (`externalPlatform`), each with a name and website |
| `instructions` | How to set it up, including how to get any keys the settings ask for                                                           |
| `changelog`    | Release notes for every version. See [Changelog](https://developer.kustomer.com/docs/apps/versioning#changelog).               |

## Review checklist

Apps that miss any of these are sent back.

- [ ] **Fully tested** in a Kustomer org, every component and every setting.
- [ ] **No beta versions.** Use private apps for beta testing.
- [ ] **No placeholders**: no lorem ipsum, test URLs, or "coming soon" settings.
- [ ] **No hidden features.** Everything the app does is described in the listing.
- [ ] **Works in dark mode.** Check KViews, widgets and custom settings pages. See [Support dark mode](https://developer.kustomer.com/docs/apps/kviews#support-dark-mode).
- [ ] **No manual Kustomer setup** beyond the app's settings page. The definition must create everything the app needs.
- [ ] **No installing components through the API.** Workflows, Klasses and other components come from the definition, not from your server calling the Kustomer API after install.
- [ ] **No manual setup in the external platform.** If admins must authorize access there, use [OAuth](https://developer.kustomer.com/docs/apps/oauth#call-third-party-apis-with-oauth).
- [ ] **Demo account provided** for the external platform, so reviewers can test end to end.
- [ ] **Data disclosure** in the description: what goes to third parties, when and why.
- [ ] **Release notes** for the submitted version.

## Data and security questionnaire

Every submission includes a questionnaire about how the app handles customer data. Expect questions about:

- **Privacy**: what data you store, where, for how long, and who can access it.
- **Certifications**: SOC 2, ISO 27001 or similar, if you have them.
- **Security**: encryption in transit and at rest, access controls, and incident response.

Apps that send data out of Kustomer, such as with [outbound webhooks](https://developer.kustomer.com/docs/apps/workflows-actions-triggers#outbound-webhooks), get the closest scrutiny, so describe each flow and why the app needs it.

## Submit

1. Finish the checklist above.
2. Fill in the [marketplace submission form](https://forms.gle/u5vWAm7dgVx68iQY7) with your listing details, the questionnaire, and demo credentials.
3. Attach the definition JSON, logo and screenshots.

Review takes **4 to 6 weeks**. Kustomer may come back with changes, and you resubmit after fixing them.

## Updates

Every update is a new version, reviewed in proportion to what changed:

| Change                                     | Review                                            |
| ------------------------------------------ | ------------------------------------------------- |
| **Major** (`2.0.0`)                        | Full review again, including privacy and security |
| **Minor** (`1.5.0`) or **patch** (`1.4.3`) | Review of what changed in the version             |
| **Critical bug fix**                       | Expedited. Say it's critical when you submit.     |

Changing `roles` always needs a major version. See [Versioning and updates](https://developer.kustomer.com/docs/apps/versioning#choose-the-bump) for which bump to use.