diff --git a/src/routes/apps.js b/src/routes/apps.js
index 3d85901e1..038506112 100644
--- a/src/routes/apps.js
+++ b/src/routes/apps.js
@@ -119,6 +119,9 @@ function installApp(req, res, next) {
     // allow tests to provide an appId for testing
     var appId = (process.env.BOX_ENV === 'test' && typeof data.appId === 'string') ? data.appId : uuid.v4();
 
+    // addons is optional
+    data.manifest.addons = data.manifest.addons || {};
+
     debug('Installing app id:%s storeid:%s loc:%s port:%j restrict:%s manifest:%j', appId, data.appStoreId, data.location, data.portBindings, data.accessRestriction, data.manifest);
 
     apps.install(appId, data.appStoreId, data.manifest, data.location, data.portBindings || null, data.accessRestriction, data.icon || null, function (error) {
@@ -253,6 +256,9 @@ function updateApp(req, res, next) {
     if ('icon' in data && typeof data.icon !== 'string') return next(new HttpError(400, 'icon is not a string'));
     if ('force' in data && typeof data.force !== 'boolean') return next(new HttpError(400, 'force must be a boolean'));
 
+    // addons is optional
+    data.manifest.addons = data.manifest.addons || {};
+
     debug('Update app id:%s to manifest:%j', req.params.id, data.manifest);
 
     apps.update(req.params.id, data.force || false, data.manifest, data.portBindings, data.icon, function (error) {