Allowlist feeds

Published files

Allow continuously publishes feed files for each allowlist. Only Allowed entries are included; Queued, Vetting, Blocked, and Cannot vet entries are excluded.

The feed can contain:

• extensions.allowed.json — the Visual Studio Code extension map;
• AllowedExtensions.string.txt — the same map encoded as a JSON string;
• allowlist.unsigned.json — an object with an extensions.allowed property; and
• allowlist.json — a signed envelope when signing is configured.

An extension map looks like this:

{
  "ms-python.python": ["2026.10.0"]
}

A value of true means the extension is not version-pinned.

Signed envelope

allowlist.json contains payload, sig, and alg: "RS256". The decoded payload uses schema codeguardian.allowlist/v1 and includes the organization, feed version, issue time, and allowed extension map.

Use the generated Intune package when possible because it already implements signature and anti-rollback verification.

Access

Each allowlist has its own feed URL and deployment token. Downloaded deployment packages include that token. A custom client must send the token as X-Feed-Token when token enforcement is enabled. Rotating a token creates a new token; explicitly revoke the previous token when it should stop working.