Licensing

API reference

Verify, activate and deactivate endpoints.

Licence API

All endpoints are rate limited per key and per address, and every response is signed so a client can detect tampering by an intermediary.

Verify

POST /v1/licenses/verify
Content-Type: application/json

{
  "key": "VS-XXXX-XXXX-XXXX-XXXX",
  "productSlug": "sentinel",
  "fingerprint": "b1c2d3e4f5"
}

{
  "valid": true,
  "status": "ACTIVE",
  "productSlug": "sentinel",
  "activations": { "used": 1, "limit": 3 },
  "expiresAt": null,
  "signature": "…",
  "signedAt": "2026-08-15T09:00:00.000Z"
}

Activate

POST /v1/licenses/activate

{
  "key": "VS-XXXX-XXXX-XXXX-XXXX",
  "productSlug": "sentinel",
  "fingerprint": "b1c2d3e4f5",
  "label": "eu-survival-01"
}

Returns 409 with code LICENSE_ACTIVATION_LIMIT when the limit is reached.

Deactivate

POST /v1/licenses/deactivate

{
  "key": "VS-XXXX-XXXX-XXXX-XXXX",
  "fingerprint": "b1c2d3e4f5"
}

Verifying the signature

Responses are signed with HMAC-SHA256 over the canonical JSON body excluding the signature field. Your product ships with the public verification material; treat a signature mismatch as a failed verification.

Errors

Code	Meaning
`LICENSE_NOT_FOUND`	No licence matches the key.
`LICENSE_SUSPENDED`	The licence is temporarily disabled.
`LICENSE_REVOKED`	The licence is permanently disabled.
`LICENSE_EXPIRED`	The licence period has ended.
`LICENSE_ACTIVATION_LIMIT`	No activation slots remain.
`RATE_LIMITED`	Too many requests; retry after the stated interval.

Last updated 15 Aug 2026

Something wrong on this page? Tell us.