Product and license API
Issue licenses from your own server after an order: create the product and policy, then a license for each customer. Usually the product and policy are configured once.
First create a write-enabled Management API key. The examples below use Authorization: Bearer YOUR_MANAGEMENT_API_KEY; keep this key on the vendor's server.
The examples above show the minimum issuance flow. For queries, updates, archiving, renewals, devices, usage, offline licensing and events, see “All management requests and responses” under Management API Key.
Enter validity days when issuing a license: 1–36500 for timed and trial licenses, and none for perpetual licenses. Policies do not store validity days.
Use the product response data.id as product_id and the policy response data.id as policy_id. After issuing a license, save data.id and data.key.
You can view and copy the full key again from the license list. Share it only with the corresponding customer.
For a timed license before activation,expires_at and first_activated_at are null. The term starts at first successful activation; transfer does not grant a fresh term.
Further management
| Method and path (without /api/v1) | Purpose and request body |
|---|---|
GET /products | List products. In the response, data.items is the record array and data.total is the total count. |
GET /licenses/{id} | Read license details, first activation and expiration. |
POST /licenses/{id}/renew | Renew, e.g. {"days":30}. Keeps the original license. |
POST /licenses/{id}/revoke | Revoke; request body is {}. |
GET /products/{id}/public-keys | Read the product's public keys without authentication. Pin trusted keys when distributing the SDK. |
GET /activations | View device bindings and runtime sessions. |
List pagination uses limit=25&offset=0, limit is at most 100. Other parameters and schemas are in OpenAPI file; see the relevant topic on the left for each license model.
How do I call with a browser login session?
Writes using browser cookies require X-CSRF-Token. First GET /api/v1/auth/csrf, then put data.csrf_token in that header. Bearer Key requests do not require CSRF.