Licenses (add-on)

Search issued license keys, newest first, each with its status, its project name, the seats in use against the seats allowed, its product, its order, its customer and its two dates. q matches a fragment of a key, the project name the customer gave it, a buyer's email or an order number, which are the four things a support conversation ever starts with. Status expired is derived from the expiry date every time it is asked and is never stored, so an expired key appears under expired and not under active. Use get_license for one key with its activations and the delivery copy the customer was sent.

One key with everything it knows about itself: the row and its effective status, every machine it has been activated on including the seats already freed, the product, variant, customer and order behind it, the licensing rule that governs it, every add-on that has been bought onto it, and a preview of the delivery copy and license files the customer receives. Call this before suspending, revoking or freeing a seat, because the activation ids free_license_seat needs are only here.

Mint a key with no order behind it, for a comp, a review copy or a replacement for somebody who bought through another channel, and return it the way get_license does. No order is invented to hang it on, so nothing lands in the store's revenue reports. A product is required and an unknown product, an unknown customer or a variant belonging to a different product answers 422. Name the owner by customer_id or by email; an email that already has an account gets the key on that account and a new one gets an account. seats, term_days and updates_days fall back to the store defaults when omitted, and sending any of them as null means unlimited seats, a perpetual key or updates forever. The key is drawn in the product rule's own layout and carries its prefix, so a comp key looks like the product's other keys, and the same delivery email an order-issued key triggers goes out.

Change what a merchant is allowed to change on an issued key: the project name, the seat allowance, the expiry, the updates window, the private note, the metadata and who it belongs to. Only the fields sent are touched, and a null on seats, expires_at or updates_until clears the limit rather than zeroing it. Lowering seats below the machines already holding one is refused with 409 seats_below_live, and the whole request is left unapplied when that happens, so a rejected seat change never half-saves the expiry beside it. Pushing the two dates out is how an operator extends a key by hand; a customer buying more time does it through a renewal product instead, which extends from max(now, current updates_until) and writes the extension on the order.

Switch a key off for now, which is the one to use for a chargeback under investigation or a customer in arrears. Validation starts answering valid: false with status suspended, and the activations are left in place on purpose so reinstate_license puts the customer back exactly where they were rather than making them reactivate twelve machines by hand. Suspending an already suspended key is a no-op success; a revoked key answers 409 invalid_transition, because revocation is permanent. Returns the same payload get_license does.

Undo a suspension and put the key back to active with its activations untouched. Reinstating an already active key is a no-op success. A revoked key cannot be reinstated and answers 409 invalid_transition: revocation exists precisely so a key can stop working permanently, and issue_license or regenerate_license is the way to give the customer a working key again. Returns the same payload get_license does.

Kill a key permanently and free every seat it holds. There is no way back from this: a revoked key cannot be suspended, reinstated or renewed, it has no license files, and the only remedy for a mistake is issuing a new key. A reason is required and is kept on the record forever, because "revoked, nobody remembers why" is a support ticket waiting to happen. Revoking an already revoked key answers 409 revoked. Prefer suspend_license for anything reversible. Returns the same payload get_license does.

Replace a leaked key. The current key is revoked rather than deleted, so software still holding it is told plainly that it is dead, and a fresh key is minted carrying the same order, customer, product, variant, seats and dates, drawn in the product rule's own layout. This is destructive on the old key and cannot be undone. The response is the new key's get_license payload with the revoked one under previous.