Public check API

The Java, Node.js, and Python SDKs call the public check API for Full Online and Hybrid licences. Prefer the SDK instead of implementing this protocol yourself.

Request

POST /o/{slug}/api/public/license/check
Content-Type: application/json

{
  "license": "<complete licence string>",
  "fingerprint": "DYC1.<hashed parts>.<checksum>"
}

The request sends the complete signed licence and the current machine’s fingerprint. The fingerprint contains separately hashed component values, never the raw identifiers.

The first successful check binds a Full Online or online-activated Hybrid licence. A later fingerprint from another machine is rejected without replacing the existing binding.

Response

{
  "status": "ACTIVE",
  "valid": true,
  "lid": "24ec2229-0d0c-41f8-9eed-439fd5b5b789",
  "boundAt": "2026-08-14T09:11:00Z",
  "checkedAt": "2026-08-20T07:00:00Z",
  "serverTime": "2026-08-20T07:00:00Z"
}

Depending on the licence, the response may include expiry, grace, revocation time and reason, or other status context. Null fields can be omitted.

Possession of a correctly signed licence is the credential. The service verifies it before looking up its record so arbitrary licence IDs cannot be enumerated.

Error handling

The SDK combines the verified local result with the response and enforces the signed offline window. Timeouts, disabled checking, rate limits, and service errors are reported as an unavailable online answer rather than a successful status.

Do not send a licence that already failed local verification. The official SDKs perform this check before making the request.